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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASS OCIATED 
ACC 


ITH THE TWITTER 



Case No. 17-MJ-567 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)'. 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)\ 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _ August 21, 2017 _ (not to exceed 14 days) 

^ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howell _. 

(United States Magistrate Judge) 


□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) 0 until, the facts justifying, the later specific date of '• __ 


Date and time issued: 





City and state: Washington, D.C. Hon. Beryl A. HoweJf'Chief U.S. District Judge 

. Printed name and title 
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ATTACHMENT A 


Property to Be Searched 

This warrant applies to information associated with the Twitter profile with usernames: 



that is stored at premises owned, maintained, controlled, or operated by Twitter, a company 
headquartered in San Francisco, California. 
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ATTACHMENT B 
Particular Things to be Seized 
I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, including any messages, records, files, logs, or information that 
have been deleted but are still available to Twitter, or have been preserved pursuant to a request 
made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the 
government for each account listed in Attachment A: 

a. All identity and contact information, including full name, e-mail address, physical 
address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers; 

b. All past and current usernames, account passwords, and names associated with 
the account; 

c. The dates and times at which the account and profile were created, and the 
Internet Protocol (“IP”) address at the time of sign-up; 

d. All IP logs and other documents showing the IP address, date, and time of each 
login to the account; 

e. All data and information associated with the profile page, including photographs, 
“bios,” and profile backgrounds and themes; 

f. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the 
account, and all photographs or images included in those Tweets and Direct 


Messages; 
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g. All information from the “Connect” tab for the account, including all lists of 
Twitter users who have favorited or retweeted Tweets posted by the account, as 
well as a list of all Tweets that include the username associated with the account 
( i.e ., “mentions” or “replies”); 

h. All photographs and images in the user gallery for the account; 

i. All location data associated with the account, including all information collected 
by the “Tweet With Location” service; 

j. All information about the account’s use of Twitter’s link service, including all 
longer website links that were shortened by the service, all resulting shortened 
links, and all information about the number of times that a link posted by the 
account was clicked; 

k. All data and information that has been deleted by the user; 

l. A list of all of the people that the user follows on Twitter and all people who are 
following the user (i.e., the user’s “following” list and “followers” list); 

m. A list of all users that the account has “unfollowed” or blocked; 

n. All “lists” created by the account; 

o. All information on the “Who to Follow” list for the account; 

p. All privacy and account settings; 

q. All records of Twitter searches performed by the account, including all past 
searches saved by the account; 

r. All information about connections between the account and third-party websites 
and applications; 
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s. All records pertaining to communications between Twitter and any person 

regarding the user or the user’s Twitter account, including contacts with support 
services, and all records of actions taken, including suspensions of the account. 


3 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and 
instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection 
with computers) involving since March 1, 2016 including, for each user ID identified on 
Attachment A, information pertaining to the following matters: 

a. Any correspondence regarding hacked emails or other data from the 
Democratic National Committee (DNC) and the email belonging to John 
Podesta (“the email hack”); 

b. Any communications between the Target Accounts and individuals 
associated with the email hack; 

c. Any communications indicating any advance knowledge or direction, 
planning, or control of the email hack; 

d. Evidence indicating how and when the Twitter account was accessed or used, 
to determine the chronological and geographic context of account access, use, 
and events relating to the crime under investigation and to the Twitter account 
owner; 

e. Evidence indicating the Twitter account owner’s state of mind as it relates to 
the crime under investigation; 

f. The identity of the person(s) who created or used the user ID, including 
records that help reveal the whereabouts of such person(s). 

g. The identity of the person(s) who communicated with the accounts about 
matters related to 18 U.S.C. § 1030, including records that help reveal their 
whereabouts. 


4 
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AO 106 (Rev. 04/10) Application for a Search Warrant 

United States District Court 

for the 

District of Columbia 
) ■ 

) Case No. 17-MJ-567 

) 

) 

) 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A. 

located in the _ Northern _ District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B. 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more)'. 

EsT evidence of a crime; 

fif contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION AS SOCIATED WITH THE TWITT ER 
ACCOUNTS r 



filed 

AUG -7 2017 

C, S r ^ U - S V Distric t and 
Bankruptcy Courts 


The application is based on these facts: 


See attached Affidavit. 


$ Continued on the attached sheet. 

□ Delayed notice of _days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
jAaron Zelinsky (ASC) 



Mickey Robinson, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 
Date: 08/07/2017 


City and state: Washington, D.C. 


Judge’s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 

Case No. 17-MJ-569 

Filed Under Seal 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Mickey Robinson, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

hereafter “Target Account 

1”) and (hereafter “Target Account 2”) and that is stored at premises owned, 

maintained, controlled, or operated by Twitter, a social-networking company headquartered in 
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government 
is described in the following paragraphs and in Attachments A and B. This affidavit is made in 
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 
2703(c)(1)(A). 

2. I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working directly with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2012. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 
experience related to foreign intelligence services national security investigations, as well as 
federal financial crimes. I have conducted and participated in various investigations involving 
multiple threat countries as well as national security threats and applicable criminal violations. 


information associated with the Twitter Accounts 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH THE 



FILED 

AUG -7 2017 

Clerk, U.S. District and 
Bankruptcy Courts 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that certain individuals with whom Target Account 1 was in 
communication have committed violations of 18 U.S.C.§ 1030 (fraud and related activities in 
connection with computers), and that communications related to these violations will be found 
on the Target Accounts. There is therefore probable cause to search the information described 
in Attachment A for evidence of these crimes and contraband or fruits of these crimes, as 
described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court). .. that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below 
in paragraphs 6, 20, and 28. 

PROBABLE CAUSE 

A. The 2016 Email Hack and Russia’s Use of “Guccifer 2,0” and Wikileaks to 

Disseminate Hacked Information. 

6. According to the public and unclassified intelligence report conducted by the 
United States Intelligence Community, the Russian military intelligence (General Staff Main 


2 
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Intelligence Directorate or “GRU”) probably began cyber operations aimed at the U.S. election 
by March 2016. The GRU operations resulted in the compromise of the personal e-mail 
accounts of Democratic National Committee (DNC) and other Democratic Party officials and 
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC. 
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003. 

7. The public and unclassified intelligence report assessed that the GRU used a 
Twitter account, “Guccifer 2.0,” as well as the websitesDCLeaks.com, and WikiLeaks to release 
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets. 
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory 
statements and false claims about his likely Russian identity throughout the election. Press 
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. 

B. Roger Stone’s Interactions with Guccifer 2.0 and Wikileaks. 

8. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

9. As discussed further below, Stone made a number of public references to 
Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via 
Twitter with Guccifer 2.0. 

10. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 


3 
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hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 
21,2016 release of hacked documents. 

11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from 
the DNC. 

12. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

13. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 


4 
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14. On August 12, 2016, Guccifer 2.0 publicly tweetedarget 
Account 1] thanks that u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released 
the personal cellphone numbers and email addresses from the files of the Democratic 
Congressional Campaign Committee (DCCC). 

15. On August 13, 2016, Stone posted a tweet using Target Account 1 calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

16. On August 14, 2016, Stone sent a private message on Twitter using Target 
Account 1 to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle reinstated 
after having been suspended. 1 

17. On August 15, 2016, Guccifer 2.0 replied to Stone on Target Account 1, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 
interesting in the docs I posted.” 

1 8 . On August 1 6 , 2016, Stone sent a private message using Target Account 1 
asking Guccifer to retweet an article he had written regarding the £ rigg[ing]’ of the 2016 
presidential elections. 

19. On August 17, 2016, Guccifer 2.0 publicly tweeted,[Target 
Account 1] paying you back.” Guccifer also sent a private message to Target Account 1 stating 
“i’m pleased to say u r great man. please tell me if I can help u anyhow, it would be a great 
pleasure to me.” 


1 These messages were release by Stone on March 10, 2017, as described further below in paragraph 28. 


5 
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20. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S. 
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John 
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were 
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and 
that investigators were also examining the Podesta Group. 

21. On August 21 , 201 6 , using Target Account 1 , Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a ‘“mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected Wikileaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

23. On Saturday, October 1, 2016, using Target Account 1, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. # Wiki leaks.” 

24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 


6 
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balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of Wikileaks’ 10-year anniversary celebration - Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used Target Account 1 to tweet: “Payload coming. #Lockthemup.” 

25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

27. Wikileaks continued to release John Podesta’s hacked emails throughout October 
10-14, 2016. On October 12, 2016, John Podesta - referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I th i nk 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 


7 
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28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using Target Account 1. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

29. On or about May 12, 2017, United States Magistrate Judge Michael S. 
Nachmanoff of the Eastern District of Virginia issued an Order pursuant to 18 U.S.C. § 2705(b) 
requiring Twitter to disclose certain records, including subscriber and user activity information, 
associated with the Target Accounts described above (Case number 17-GJ-0835). On or about 
May 23, 2017, Twitter provided the FBI with records that confirmed that the Target Accounts 
are registered to Stone. 

30. As described above, it appears that Stone has used the private messaging function 
of Target Account 1 to communicate with Guccifer 2.0. I know in my training and experience 
that individuals with multiple accounts on the same service, such as Stone has on Twitter, often 
use both accounts for their communications. A review of Target Account 2’s publicly available 
information indicates that it has been in use since November 2015. Stone also appears to 
comment using Target Account 2 frequently. Stone also often publicly “Retweets” messages 
using Target Account 2 which originated from Target Account 1. Therefore there is probable 
cause to believe that messages pertaining to the investigation, including messages to individuals 
regarding the hack, as well as communications with Guccifer 2.0, will be found on Target 
Account 1 and Target Account 2. 

INFORMATION CONCERNING TWITTER 


8 
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31. Twitter owns and operates a free-access social-networking website of the same 
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users to create and read 140-character messages called 
“Tweets,” and to restrict their “Tweets” to individuals whom they approve. These features are 
described in more detail below. 

32. Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

33. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

34. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her 
account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 


9 
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35. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 

36. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 
account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

37. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

38. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

39. When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

40. A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 


10 



Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 18 of 21 


following that user (i. e ., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

41. In addition to posting Tweets, a Twitter user can also send DMs to one of his or 
her followers. These messages are typically visible only to the sender and the recipient, and both 
the sender and the recipient have the power to delete the message from the inboxes of both users. 
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs 
are stored on Twitter’s database. 

42. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

43. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 
25 past searches. 


11 
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44. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 

45. If a Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 

46. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

47. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter account activity can show how and when the account was accessed or 
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used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

48. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other 
account information. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

49. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Twitter to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A and 
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particularly described in Section I of Attachment B. Upon receipt of the information described in 
Section I of Attachment B, government-authorized persons will review that information to locate 
the items described in Section II of Attachment B. 

CONCLUSION 


50. Based on the forgoing, I request that the Court issue the proposed search warrant. 

51. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 


52. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Mickey Robinson 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 


7 day of August, 2017. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 
District of 


Case: 1:17-mj-00661 
Assigned To : Howell. Beryl A. 

Assian. Date : 9/11/2017 
Description. Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Nor thern District of_ California 

(identify the person or describe the property to be searched and give its location)'. 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATIO N ASSOCIATED WITH THE EM AIL ) 
ACCOUNT 

) 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before Septem b er 25, 2017 (not to exceed 14 days) 

Sf in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ _H on. Bery l A. Howell 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

^ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of 

Date and time issued: 

1 Judge’s signature 

City and state: Washingt on, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 

District of Columbia 


— 

SEP 11 2017 

Clerk. U.8. District & Bankruptcy 
. Courts fo r the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person bv name and address) 

INFORMATION ASSOCIATED WITH THE EM AIL 
ACCOUNT 


) Case: 1:17-mj-00661 
] Assigned To : Howell. Beryl A. 

) Assian Date 9/11/2017 

) Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that 1 have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Northern _District of_California_, there is now concealed (identify the 

person or describe the property to be seized)’. 

See Attachment B 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
vf evidence of a crime; 

tT contraband, fruits of crime, or other items illegally possessed; 

Sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. § 1030; Fraud and related activities in connection with computers 

18 U.S.C. § 371 Conspiracy to commit an offense against the United States 

The application is based on these facts: 


See attached Affidavit. 


Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 


) is requested 



r l , 



; ^ 

pphcant s signature 


Aaron Zelinsky (ASC) 


Amy Anderson, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 

Date: 09/11/2017 

Judge's signature 

City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH THE 
EMAIL ACCOUNT 



Case No. 

Filed Under Seal 


SEP 11 2017 

Ccui tV is n triot & Bankr »ptcy 

Court, for the District of Columbia 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Amy Anderson, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the Email Account (hereafter the “Target 

Account”), that is stored at premises owned, maintained, controlled, or operated by Microsoft 
Corp., d/b/a Hotmail, an email provider headquartered at One Microsoft Way, Redmond, WA 
98052 (hereinafter “Microsoft”). The information to be disclosed by Microsoft and searched by 
the Government is described in the following paragraphs and in Attachments A and B. This 
affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 
2703(b)(1)(A), and 2703(c)(1)(A). 

2. I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working directly with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2010. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 
experience related to espionage and foreign intelligence services national security investigations. 
I have conducted and participated in various investigations involving multiple threat countries as 
well as national security threats and applicable criminal violations. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains communications relevant to 
violations of 18 U.S.C.§ 1030 (fraud and related activities in connection with computers) and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States). As set forth below, 
Roger Stone used Twitter’s private direct messaging function to message Wikileaks, Julian 
Assange, and Guccifer 2.0, a Twitter account used by Russian intelligence to disseminate hacked 
information. Stone also repeatedly used Twitter’s private direct messaging function to instruct 
individuals to email him on the Target Account to continue conversations begun on Twitter’s 
private direct messaging system. These conversations included discussion of information related 
to the Campaign and potential derogatory information concerning a presidential candidate in the 
Republican primary. There is therefore probable cause to search the information described in 
Attachment A for evidence of these crimes and contraband or fruits of these crimes, as described 
in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United Slates (including a magistrate judge of 
such a court) . .. that has jurisdiction over the offense being investigated.” 18 U.S.C. 
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§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below 
in paragraphs 6, 20, and 28. 

PROBABLE CAUSE 

A. The 2016 Email Hack and Russia’s Use of “Guccifer 2.0” and Wikileaks to 

Disseminate Hacked Information. 

6. According to the public and unclassified intelligence report conducted by the 
United States Intelligence Community, the Russian military intelligence (General Staff Main 
Intelligence Directorate or “GRU”) probably began cyber operations aimed at the U.S. election 
by March 2016. The GRU operations resulted in the compromise of the personal e-mail 
accounts of Democratic National Committee (DNC) and other Democratic Party officials and 
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC. 
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003. 

7. The public and unclassified intelligence report assessed that the GRU used a 
Twitter account, “Guccifer 2.0,” as well as the websitesDCLeaks.com, and WikiLeaks to release 
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets. 
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory 
statements and false claims about his likely Russian identity throughout the election. Press 
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. 

B. Roger Stone’s Publicly Disclosed Interactions with Guccifer 2.0 and Wikileaks. 

8. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
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official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

9. As discussed further below, Stone made a number of public references to 
Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via 
Twitter with Guccifer 2.0. 

10. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 

21, 2016 release of hacked documents. 

11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from 
the DNC. 

12. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

13. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
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October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: ‘‘Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

14. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

15. On August 13, 2016, Stone posted a tweet using @RogerJ Stone Jr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

16. On August 14, 2016, Stone sent a private message on Twitter using 
@RogerJStoneJr to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle 
reinstated after having been suspended. 1 

17. On August 15, 2016, Guccifer 2.0 replied to Stone on Target Account 1, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 
interesting in the docs I posted.” 


1 These messages were released by Stone on March 10, 2017, as described further below in paragraph 28. 
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18. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking 
Guccifer to retweet an article he had written regarding the ‘riggfing]’ of the 2016 presidential 
elections. 

19. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

20. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S. 
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John 
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were 
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and 
that investigators were also examining the Podesta Group. 

21. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a ‘“mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 
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22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected Wikileaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

23. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #Wikileaks.” 

24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of Wikileaks’ 10-year anniversary celebration - Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

27. Wikileaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta - referring back to Stone’s August 21,2016 C- 
SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
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[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abcdin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using @RogerJ Stone Jr. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

29. On March 27, 2017, CNN reported that a representative of Wikileaks, writing 
from an email address associated with Wikileaks, denied that there was any backchannel 
communication during the Campaign between Stone and Wikileaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

C. Roger Stone’s Private Twitter Direct Messages with Wikileaks and Julian Assange. 

30. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. While the full review of that returned information is ongoing, 
the initial review indicates that, contrary to Stone’s representation to CNN that he “never 
communicated with WikiLeaks,” Stone in fact communicated via private direct messaging with 
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Wikileaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account’s private 
direct messaging system to communicate directly with Julian Assange since at least June 2017. 

31. For example, on October 13, 2016, while Wikileaks was in the midst of releasing 
the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@Wikileaks. This account is the official Twitter account of Wikileaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending wikileaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

32. Less than an hour later, @Wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don't go there if you don't want us to correct you.” 

33. On October 16, 2016, @RogerJStoneJr sent a direct message to @Wikileaks: 
“Ha! The more you V’correctY' me the more people think you're lying. Your operation leaks like 
a sieve. You need to figure out who your friends are.” 

34. On November 9,2016, one day after the presidential election, @Wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @Wikileaks 
immediately followed up with another message less than a minute later: “We are now more free 
to communicate.” 

35. In addition, @RogerJStoneJr has also recently exchanged direct messages with 
Julian Assange, the founder of Wikileaks. For example, on June 4, 2017, @RogerJ Stone Jr 
directly messaged @JulianAssange, an address associated with Julian Assange in numerous 
public reports, stating: “Still nonsense. As a journalist it doesn't matter where you get 


9 


Case l:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 13 of 23 


information only that it is accurate and authentic. The New York Times printed the Pentagon 
Papers which were indisputably stolen from the government and the courts ruled it was legal to 
do so and refused to issue an order restraining the paper from publishing additional articles. If 
the US government moves on you I will bring down the entire house of cards. With the trumped- 
up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best 
regards. R.” That same day, @JulianAssange responded: “Between CIA and DoJ they're doing 
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down 
Trump trying to squeeze us into a deal.” 

36. On Saturday, June 10, 2017, @RogerJ Stone Jr sent a direct message to 
@Wikileaks, reading: “I am doing everything possible to address the issues at the highest level 
of Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

D. Roger Stone’s Use of the Target Account to Continue Conversations Begun on 

Twitter Direct Message. 

37. Using the direct messaging function associated with the account @RogerJStoneJr, 
Stone sent direct messages to individuals instructing them to email the Target Account to 
continue conversations began via Twitter direct message. For example, on August 8, 2015, an 
individual sent @RogerJStoneJr a direct message asking if he had “a few minutes this afternoon 
to talk about all of today’s drama with Trump.” Stone responded the next day: “Sorry I missed 
this - my email [Target Account].” 

38. On August 8, 2015, an individual sent a direct message to @RogerJStoneJr 
reading: “Just got some stuff from the campaign you may want to respond to.” That same day, 
@RogerJStoneJr responded: “Such as -? My email is [Target Account].” 
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39. On August 9, 2015, an individual sent @RogerJStoneJr a direct message asking to 
arrange an interview. @RogerJStoneJr replied, “Okay - what do you need from me." The 
individual replied, “Your email address. Twitter too public.” Stone replied with the Target 
Account. 

40. On September 7, 2015, an individual sent a private direct message to 
@RogerJStoneJr containing a “White Paper,” regarding the “Most likely questions to be asked of 
Mr. Trump on Foreign Policy.” @RogerJStoneJr replied: “Send to me at [Target Account].” 

41. On February 17, 2016, an individual sent a direct message to Stone reading: “Mr. 
Stone I have a delightful story about one foul tempered governor currently pretending to be Ned 
Flanders up on the stage. Interested?” @RogerJStoneJr responded on Friday, February 19, 2016: 
“Sure—tell me what u know—[Target Account].” 

42. On March 21, 2016, an individual sent a private direct message to 
@RogerJStoneJr reading: “Im trying to get a list of upcoming Trump events so I can Fly out and 
Film these Anti-Trump protesters. To show the American people that these are the people that 
are actually creating the Chaos. No one is showing whats really going on outside at these events 
honestly and quite frankly its pissing me off.” The next day, @RogerJStoneJr responded: “Email 
me at [Target Account].” 

43. On April 30, 2016, an individual sent a private direct message to @RogerJ Stone Jr 
stating: “Give me a shout if you need a story moved. My followers are RTing fiends! lol.” 
@RogerJStoneJr responded: “Great- please e-mail me again at [Target Account].” 

44. On September 13, 2016, an individual send a private direct message to 
@RogerJStoneJr asking for a “contact info so I can stay in touch in a more appropriate way than 
Twitter DM.” @RogerJStoneJr replied, “email me at [Target Account].” 
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BACKGROUND CONCERNING HOTMAIL 

45. In my training and experience, I have learned that Microsoft provides a variety of 
on-line services, including electronic mail (“email”) access, to the public. Microsoft allows 
subscribers to obtain email accounts at the domain name Hotmail.com, like the email account 
listed in Attachment A. Subscribers obtain an account by registering with Hotmail. During the 
registration process, Hotmail asks subscribers to provide basic personal information. Therefore, 
the computers of Microsoft are likely to contain stored electronic communications (including 
retrieved and unretrieved email for Hotmail subscribers and information concerning subscribers 
and their use of Hotmail services, such as account access information, email transaction 
information, and account application information. In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. 

46. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

47. In my training and experience, email providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
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information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the provider’s website), and other log files that reflect usage 
of the account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to access 
the email account. 

48. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and 
the provider’s support services, as well as records of any actions taken by the provider or user as 
a result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

49. This application seeks a warrant to search all responsive records and information 
under the control of Microsoft, a provider subject to the jurisdiction of this court, regardless of 
where Microsoft has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic 
communications and any records or other information pertaining to the customers or subscribers 
if such communication, record, or other information is within Microsoft’s possession, custody, or 
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control, regardless of whether such communication, record, or other information is stored, held, 
or maintained outside the United States. 

50. As explained herein, information stored in connection with an email account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, 
the information stored in connection with an email account can indicate who has used or 
controlled the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email provider can show how and when the account was accessed 
or used. For example, as described below, email providers typically log the Internet Protocol 
(IP) addresses from which users access the email account, along with the time and date of that 
access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 

information stored at the user’s account may further indicate the geographic location of the 

\ 

account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
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communications relating to the crime), or consciousness of guilt (e.g ., deleting communications 
in an effort to conceal them from law enforcement). 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

51. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Hotmail to disclose to the government copies of the records and other information 
(including the content of communications) associated with the account in Attachment A and 
particularly described in Section I of Attachment B. Upon receipt of the information described in 
Section I of Attachment B, government-authorized persons will review that information to locate 
the items described in Section II of Attachment B. The items identified in Attachments A and B 
will also be screened by reviewers not on the prosecution team to identify andilter out privileged 
material. 

CONCLUSION 

52. Roger Stone used the @RogerJStoneJr to communicate directly with Wikileaks 
during the campaign, even though he publicly claimed to have “never” communicated with 
Wikileaks. He also sent private messages to Julian Assange and Guccifer 2.0, the entity which 
claimed responsibility for the DNC hack. Using @RogerJStoneJr, Stone has repeatedly 
instructed individuals to continue conversations, including particularly sensitive issues related to 
the Campaign, on the Target Account. There is therefore probable cause to believe that 
evidence of the DNC hack and the hacking of other emails associated with the 2016 election will 
be found on the Target Account. 

53. Based on the forgoing, I request that the Court issue the proposed search warrant. 
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54. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 


55. 1 further request that the Court order that all papers in support of this application, 

including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted. 



Federal Bureau of Investigation 


Subscribed and sworn to before me on this //' day of September, 2017. 

The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to Be Searched 

This warrant applies to information associated with the Account 

“Target Account'’) that is stored at premises owned, maintained, 
controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered at One 
Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 

1. Information to be disclosed by Microsoft, Corp. 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Microsoft, Corp. (hereinafter “the Provider”), regardless of whether 
such infonnation is stored, held or maintained inside or outside of the United States, and 
including any emails, records, files, logs, or information that has been deleted but is still 
available to the Provider, the Provider is required to disclose the following information to the 
government for each account or identifier listed in Attachment A2: 

a. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account, draft emails, the source 
and destination addresses associated with each email, the date and time at which 
each email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP 
addresses associated with session times and dates, account status, alternative 
email addresses provided during registration, methods of connecting, log files, 
and means and source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the 
date on which the account was created, the length of service, the types of service 
utilized, the IP address used to register the account, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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f. All search history or web history; 

g. All records indicating the services available to subscribers of the account; 

h. All usernames associated with or sharing a login IP address or browser cookie 
with the account; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and 

k. All telephone or instrument numbers associated with the Account (including 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile 
Identification Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile 
Subscriber Integrated Services Digital Network Number (“MSISDN”), 
International Mobile Subscriber Identifiers (“IMSI”), or International Mobile 
Equipment Identities (“IMEI”). 

II. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in 
connection with computers) and 18 U.S.C. §371 (conspiracy to commit and offense against the 
United States) involving Roger Stone or others associated with him and occurring after January 
1, 2015, including, for each account or identifier listed on Attachment A, information pertaining 
to the following matters: 

(a) Communications, records, documents and other files that reveal efforts by Roger 
Stone to communicate with any individuals associated with carrying out the hacks 
of the DNC or individual email addresses associated with the Clinton Campaign. 

(b) Records of any funds or benefits received by or offered to Roger Stone or an 
individuals or entities associated with him by, or on behalf of, any individuals 
associated with the hacks of the DNC or individual email addresses associated 
with the Clinton Campaign. 
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(c) Evidence indicating how and when the account was accessed or used, to 
determine the geographic and chronological context of account access, use, and 
events relating to the crimes under investigation and to the account owner; 

(d) Evidence indicating the account owner's state of mind as it relates to the crimes 
under investigation; 

(e) The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s). 

(f) The identity of any person(s)—including records that help reveal the person(s)’ 
whereabouts—who communicated with the account about any matters relating to 
activities conducted by Roger Stone on behalf of, for the benefit of, any 
individual associated with hacks of the DNC or individual email addresses 
associated with the Clinton Campaign. 
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AO 93 (Rev 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

j Case: 1:17-mj-00760 
) Assigned To : Howell, Beryl A. 

) Assign. Date : 10/17/2017 
) Description: Search and Seizure Warrant 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern District of _ California_ 

(identify the person or describe the property to be searched and give its location)\ 

See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 



YOU ARE COMMANDED to execute this warrant on or before October 31,2017 _ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to _ Hon. Ber y l A. Howel l 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _ ____ _ , 



City and state: 


Washington, DC 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Google account: 



that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business 
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by Google, Inc. between January 1, 2015 and 
the Present. 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the 
account, including copies of e-mails sent to and from the account, draft e-mails, the 
source and destination e-mails sent addresses associated with each e-mail, the date and 
time at which each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private 
messages, and comments; 

k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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-—- FILED- 


United States District Court 

for the 

District of Columbia 


OCT 1 7 2017 

Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 



) Case: 1:17-mj-00760 
) Assigned To : Howell, Beryl A. 

] Assign. Date : 10/17/2017 
) Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

1, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A. 

located in the _ Northern_ __ District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)’. 

See Attachment B. 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
vf evidence of a crime; 

Ilf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
18 U.S.C. §1030 
18 U.S.C. §2 
22 U.S.C. § 371 


Offense Description 

Fraud and Related Activities in Connection with Computers Agents 
Aiding and Abetting 

Conspiracy to Commit an Offense Against the United States 


The application is based on these facts: 


See attached Affidavit. 

Continued on the attached sheet. 

□ Delayed notice of_ days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103 a, the basis of which is set forth on the attached sheet. 


Amy Anderson, Special Ag ent, FB I 

Printed name and title 


Reviewed by AUSA/SAUSA: 
Aaron Zelinsky (ASC) 



Sworn to before me and signed in my presence. 


Date: 10/17/2017 



Judge’s signature 


Hon. Beryl A. Howell, Chief U.S. Distri ct Judg e 


City and state: Washingt on, D C. 


Printed name and title 
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OCT 1 7 2017 


IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy 
FOR THE DISTRICT OF TOT T tmrt a Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 


Case: 1:17-mj-00760 
Assigned To : Howell, Beryl A. 

Assign. Date : 10/17/2017 
Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Amy Anderson, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for 

information associated with the email account (hereafter the “Target 

Account”), that is stored at premises owned, maintained, controlled, or operated by Google, 
Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
The information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments A and B. This affidavit is made in support of an 
application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

2. I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working directly with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2010. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 
experience related to espionage and foreign intelligence services national security investigations. 
I have conducted and participated in various investigations involving multiple threat countries as 
well as national security threats and applicable criminal violations. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
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to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains communications relevant to 
violations of 18 U.S.C. § 1030 (fraud and related activities in connection with computers), 18 
U.S.C. § 2 (aiding and abetting), and 18 U.S.C. § 371 (conspiracy to commit an offense against 
the United States). 

5. As set forth below, Roger STONE communicated directly via Twitter with 

WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used by Russian intelligence to 
disseminate hacked information. STONE, using his Account, also emailed instructions 

to Jerome CORSI to “Get to Assange” in person at the Ecuadorian Embassy and “get pending 
WikiLeaks emails[.]” CORSI emailed STONE back on his^^^B Account that it was “Time 
to let more than Podesta to be exposed” (before any of Podesta’s were leaked). After Podesta’s 
emails were leaked, CORSI emailed STONE “talking points” about Podesta to the Target 
Account. CORSI also emailed the Target Account to convey information “from a very trusted 
source” regarding Julian ASSANGE, WikiLeaks, and potential future disclosures. In addition, 
STONE used the Target Account to continue conversations via email that he began on Twitter 
and forwarded emails, including at least one related to WikiLeaks, from his account to 

the Target Account. 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
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such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 7. 

PROBABLE CAUSE 

A. The 2016 Email Hack and Russia’s Use of “Guccifer 2.0” and WikiLeaks to 

Disseminate Hacked Information. 

7. According to the public and unclassified intelligence report conducted by the 
United States Intelligence Community, the Russian military intelligence (General Staff Main 
Intelligence Directorate or “GRU”) probably began cyber operations aimed at the U.S. election 
by March 2016. The GRU operations resulted in the compromise of the personal e-mail 
accounts of Democratic National Committee (DNC) and other Democratic Party officials and 
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC. 
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003. 

8. The public and unclassified intelligence report assessed that the GRU used a 
Twitter account, “Guccifer 2.0,” as well as the websitesDCLeaks.com, and WikiLeaks to release 
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets. 
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory 
statements and false claims about his likely Russian identity throughout the election. Press 
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. 

B. Roger Stone’s Publicly Disclosed Interactions with Guccifer 2.0 and WikiLeaks. 

9. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
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official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

10. As discussed further below, Stone made a number of public references to 
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via 
Twitter with Guccifer 2.0. 

11. On June 14,2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 
21, 2016 release of hacked documents. 

12. On July 22,2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

13. On August 5,2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

14. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 


4 


Case l:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 10 of 25 


October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

15. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

16. On August 13,2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

17. On August 14, 2016, Stone sent a private message on Twitter using 
@RogerJStoneJr to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle 
reinstated after having been suspended. 1 

18. On August 15, 2016, Guccifer 2.0 replied to Stone at @RogerJStoneJr, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 
interesting in the docs I posted.” 


i 


These messages were released by Stone on March 10, 2017, as described further below in paragraphs 


t&A 
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19. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking 
Guccifer to retweet an article he had written regarding the ‘rigg[ing]’ of the 2016 presidential 
elections. 

20. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStone Jr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

21. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

22. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day. 
Stone reiterated that because of the work of a ‘“mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

23. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 
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24. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

25. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of WikiLeaks’ 10-year anniversary celebration - Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

26. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

27. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

28. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21,2016. On October 12, 2016, John Podesta - referring back to Stone’s August 21,2016 C- 
SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
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him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

29. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

30. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

C. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 

31. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStone Jr. Contrary to Stone’s representation to CNN that he “never 
communicated with WikiLeaks,” Stone in fact communicated via private direct messaging with 
WikiLeaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account’s private 
direct messaging system to communicate directly with Julian Assange since at least June 2017. 

32. For example, on October 13, 2016, while WikiLeaks was in the midst of releasing 
the hacked Podesta emails, @RogerJ Stone Jr sent a private direct message to the Twitter account 
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@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

33. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

34. On October 16,2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you Y'correctY' me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 

35. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 
communicate.” 

36. In addition, @RogerJStoneJr has also recently exchanged direct messages with 
Julian Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr 
directly messaged @JulianAssange, an address associated with Julian Assange in numerous 
public reports, stating: “Still nonsense. As a journalist it doesn't matter where you get 
information only that it is accurate and authentic. The New York Times printed the Pentagon 
Papers which were indisputably stolen from the government and the courts ruled it was legal to 
do so and refused to issue an order restraining the paper from publishing additional articles. If 
the US government moves on you I will bring down the entire house of cards. With the trumped- 
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up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best 
regards. R.” That same day, @JulianAssange responded: “Between CIA and DoJ they're doing 
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down 
Trump trying to squeeze us into a deal.” 

37. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

D. Roger Stone’s Emails Regarding WikiLeaks, Julian Assange, Russia, and John 

Podesta 

38. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE’s 
Account”). Emails recovered pursuant to that search warrant indicated the following: 

39. On July 25, 2016, STONE sent an email from his Account to JEROME 

CORSI, an author and political commentator, with the subject line, “Get to Assange.” The body 
of the message read: “Get to Assange [a]t Ecuadorian Embassy in London and get pending 
WikiLeaks emails...they deal with Foundation, allegedly.” 

40. On or about August 2, 2016 (approximately 19 days before STONE publicly 

tweeted about “Podesta’s time in the barrel”), CORSI emailed the Account, “Word is 

friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to 
be very damaging .. .Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to 
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much 


address, I 


(the ‘1 
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of next dump focus, setting stage for Foundation debacle.” Based on my training, experience, 
and review of materials in this case, it appears that CORSI’s reference to a “friend in embassy 
[who] plans 2 more dumps” refers to Julian ASSANGE, the founder of WikiLeaks, who resided 
in Ecuador’s London Embassy in 2016. 

41. On or about August 16,2016, CORSI emailed the Target Account link to a piece 
CORSI had written about STONE titled, “Trump Adviser: WikiLeaks Plotting Email Dump to 
Derail Hillary.” 

42. On or about August 31, 2016, CORSI emailed the Account: “Did you get 

the Podesta writeup.” STONE replied “yes.” 

43. On or about September 6, 2016, CORSI emailed the Account: “Roger[,] 

Is NY Post going to use the Pedesta [sic] stuff?” 

44. On or about October 4, 2016 STONE forwarded an email from his 
Account to the Target Account with the subject line “Comment on WikiLeaks?” The email, 
from a reporter, asked STONE for any comment on the “lack of an ‘October surprise’ release 
from WikiLeaks today?” 

45. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 

46. On or about October 12, 2016, the same day on which Podesta accused STONE of 

having advance knowledge of the publication of his emails, CORSI emailed STONE on both the 
Target Account and the Account, with a subject line “Podesta talking points.” Attached 

to the email was a file labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The 
“talking points” included the statement that, “Podesta is at the heart of a Russian-govemment 
money laundering operation that benefits financially Podesta personally and the Clintons through 
the Clinton Foundation.” CORSI followed up several minutes later with another email to the 
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Target Account and the ^^^^jAccount titled, “Podesta talking points,” with the text “sent a 
second time just to be sure you go it.” STONE emailed CORSI back via the Account, 

“Got them and used them.” 

47. On or about October 17, 2016, CORSI emailed the Target Account and the 
Account with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a 

very trusted source,” and forwarded an email with the header information stripped out, showing 
only the body text. The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador 
and U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a 
set of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ 

Only hope is that if Trump speaks out to save him[.] Otherwise he’d dead anyway, once he’s 
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange 
has to play out. He’s called Podesta’s bluff and raised him the election.” 

48. On or about January 7, 2017, emailed the Target Account, 

the Account, CORSI, and with the subject line, “in case you need 

his mail.” Attached to the message was a scan of a business card for John Podesta. 

Several hours later,replied to all recipients, including the Target Account, “Ha... 
maybe he wants to go phishing with us?” 

49. I know from my training and experience that the term “phishing” is used to refer 
to the practice of sending emails purporting to be from a reputable party in order to induce 
individuals to reveal personal information, including passwords. Public reports indicate that 
Podesta’s emails were obtaining through a “phishing” scheme. 

E. Roger Stone’s Use of the Target Account to Continue Conversations Begun on 

Twitter Direct Message. 
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50. STONE has also used Target Account to continue conversations began via 
Twitter direct message. For example, on August 18, 2016, an individual sent @RogerJStoneJr a 
direct message asking “know where to send information to” regarding “Presidential polls and 
why cycle favors Trump.” Stone responded: “[Target Account].” 

51. On August 19, 2017, an individual sent a direct message to @RogerJStoneJr 
concerning an offer for “$500 for a 30 minute phone call,” stating that “My audience would be 
fascinated by discussion.” The individual then direct messages Stone, “Hi Roger! I'm striking 
out with your rep. Hoping we can swing something this week. My offer still stands.” 
@RogerJStoneJr wrote back: “Email me direct [Target Account].” 

BACKGROUND CONCERNING GOOGLE 

52. Google provides numerous free services to the users with a Google profile. Some 
of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+ 
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging 
service that provides both text and voice communication. Google Talk conversation logs are 
saved to a “Chats” area in the user’s Gmail account. Google+ is a social networking service. 
Google Drive is a file storage and synchronization service which provides users with cloud 
storage, file sharing, and collaborative editing. Google+ Photos (formerly knowns as Picasa Web 
Albums) is an image hosting and sharing web service that allows users with a Google account to 
store and share images for free. YouTube is a free video sharing website that allows users 
upload, view, and share videos. Google also retains a record of searches conducted by the user, 
as well as location data for the use of some of the services described above. All of these services 
may record information uploaded, inputted, or gathered from the user. 
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53. In my training and experience, in addition to information such as search history 
can help to show the state of mind of an individual at the time the search was made, as well as 
the individuals potential advance knowledge of events, as they search to see if the anticipated 
event has occurred. Individuals who communicate via Gmail also often use other Google 
products, including Google Talk, to communicate, and Google Drive to store or transfer, open, or 
edit files. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

54. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the account in Attachment A and 
particularly described in Section I of Attachment B. Upon receipt of the information described 
in Section I of Attachments B, government-authorized persons will review that information to 
locate the items described in Section II of Attachments B. The items identified in Attachments A 
and B will also be screened by reviewers not on the prosecution team to identify and filter out 
privileged material. 

CONCLUSION 

55. STONE instructed CORSI via the Account to “Get to Assange” at the 

Ecuadorian Embassy regarding upcoming leaks, and CORSI emailed Stone on the|^Hi 
Account that it was “Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC.” CORSI later emailed STONE “talking points” about Podesta to the 
Target Account, and also emailed the Target Account to convey information “from a very 
trusted source” regarding ASSANGE, WikiLeaks, and potential disclosure. STONE also used 
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the Target Account to continue conversations via email that he began on Twitter and forwarded 
emails related to WikiLeaks from the^^^J Account to the Target Account. There is 
therefore probable cause to believe that evidence of the DNC hack and the hacking of other 
emails associated with the 2016 election will be found in the information associated with the 

Target Account. 

56. Based on the forgoing, I request that the Court issue the proposed search warrant. 

57. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


58. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Federal Bureau of Investigation 


Subscribed and sworn to before me on this 



day of October, 2017. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Google account: 



that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business 
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by Google, Inc. between January 1, 2015 and 
the Present. 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the 
account, including copies of e-mails sent to and from the account, draft e-mails, the 
source and destination e-mails sent addresses associated with each e-mail, the date and 
time at which each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private 
messages, and comments; 

k. Google-i- Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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II. Information to be Seized by Law Enforcement Personnel 

a. Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and 
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January 
2015 to the present, including: 

All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange; 

b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 


c. Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 

d. Evidence of the times the account was used; 

e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 

i. All “address books” or other lists of contacts. 


20 


Case l:19-mc-00029-CRC 

AO 106 (Rev. 04/10) Application for a Search Warrant 


Document 29-4 Filed 04/28/20 Page 1 of 31 

— -—-- FTFEE* 


United States District Court nov - 6 2017 


for the 

District of Columbia 


Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THE TWITTER 
ACCOUNTS! 


Aligned To Howell, Beryl A 

Assign Date: 11/6/2017 

Descript,on: Search and Seizure Vterrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A. 

located in the _ Northern _ District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B. 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

l?f property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
18 U.S.C. § 1030 
18 U.S.C. §371, §2 
50 U.S.C. §30121 


Offense Description 

Fraud and Related Activities in Connection with Computers 
Conspiracy Against the United States, Aiding and Abetting 
Foreign Contribution Ban 


The application is based on these facts: 


See attached Affidavit. 


Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
Aaron Zelinsky (ASC) 



Amy Anderson, Spec ial Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 


Date: 11/6/2017 



Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: W a shing ton, D .C. 


Printed name and title 
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PILED 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH THE 


AND 


NOV ~B 7M7 

IN THE UNITED STATES DISTRICT COURT 0 

FOR THE DISTRICT OF COLUMBIA ft t JggJ 


TWITTER ACCOUNT | 


Case: 1:17-mj-00821 
Assigned To : Howell, Beryl A. 

Assign. Date : 11/6/2017 
Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Amy Anderson, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. 1 make this affidavit in support of an application for a search warrant for 

information associated with the Twitter Accounts (hereafter “Target Account I”) 

and (hereafter “Target Account 2”), that is stored at premises owned, 

maintained, controlled, or operated by Twitter, a social-networking company headquartered in 
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government 
is described in the following paragraphs and in Attachments A and B. This affidavit is made in 
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 
2703(c)(1)(A). 

I 

2. I am a Special Agent with Federal Bureau of Investigation (“FBI”) working 
directly with the Special Counsel’s Office. I have been a Special Agent with the FBI since 2010. 
Since then, I have conducted national security investigations of foreign intelligence services, 
espionage, and counter proliferation matters. I have training and experience related to espionage, 
foreign intelligence services, and national security investigations. I have conducted and 
participated in various investigations involving multiple threat countries as well as national 
security threats and applicable criminal violations. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that certain individuals with whom the Target Accounts were 
in communication have committed violations of 18 U..S.C. § 1030 (fraud and related activities in 
connection with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 2 (aiding 
and abetting), 18 U.S.C. § 371 (conspiracy to commit an offense against the United States), and 
that communications related to these violations will be found on the Target Accounts. There is 
therefore probable cause to search the information described in Attachment A for evidence of 
these crimes and contraband or fruits of these crimes, as described in Attachment B. 

5. As detailed further below, from on or about June 22, 2016, through at least on or 

about July 17, 2016, Target Account 1, belonging to WikiLeaks, exchanged numerous direct 
messages concerning hacked information with Guccifer 2.0, which was a Twitter account used 
by the Russian Government to release data obtained through hacking accounts of U.S. users. 
Target Account 1 also sent direct messages via Twitter concerning a “guessed” password for the 
website Target Account 2 belongs to Julian Assange, 

the founder of WikiLeaks. Beginning no later than on or about July 2016, former Campaign 
adviser Roger Stone was in contact with Assange via an intermediary regarding upcoming leaks 
of hacked information obtained by WikiLeaks. In addition, Assange, using Target Account 2, 
communicated directly with Stone beginning no later than on or about April 7, 2017. Stone 
stated to Target Account 2 that he was “doing everything possible to address the issues [related 
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to WikiLeaks] at the highest level of Government,” and that he and Target Account 2 “must be 
circumspect in this forum as experience demonstrates it is monitored.” 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below 
in paragraph 9. 

PROBABLE CAUSE 

A. Background on the Target Accounts, Julian Assange, and Roger Stone. 

7. Target Account 1 is the public account of WikiLeaks. As detailed further below, 
it frequently has been used to release hacked information, including during the 2016 election. 
Target Account 2 is the public account of Julian Assange. Target Account 2 has over 500,000 
followers, but only follows one account, Target Account 1. Target Account 2 frequently 
tweets information related to WikiLeaks and tags Target Account 1. 

8. Julian Assange is the founder of WikiLeaks. According to the publicly-accessible 
profile of Target Account 2, Assange currently is the “Publisher @WikiLeaks [Target Account 
1].” Target Account 2’s profile contains a link to the website “IamWikiLeaks.org\donate.” 
According to publicly-available press reporting, Assange began hacking secure computer 
systems when he sixteen years old, in 1987. On or about December 1996, Assange pled guilty in 
Australia to twenty-five charges related to hacking secure computer systems. In 2006, Assange 
and others established WikiLeaks, and he previously described himself as WikiLeaks’s Editor- 
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in-Chief. Assange has stated in public interviews that he is deeply involved in running 
WikiLeaks. Referring to the DNC emails, Assange stated in an August, 2017 interview that, “We 
had quite some difficulties to overcome, in terms of the technical aspects, and making sure we 
were comfortable with the forensics,” and that “You have to get close and interact with it, then 
you start to get a feel.” Assange indicated that only a small number of people, including himself, 
worked on the release of the DNC emails. Assange stated in August 2016 to a news organization 
that, “We are working around the clock. We have received quite a lot of material.” 

9. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone officially worked on the presidential 
campaign of Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. After 
Stone’s public departure from the Campaign, Stone continued to correspond with individuals 
related to the Campaign, including Paul Manafort (who worked for a time as Campaign 
manager), Rick Gates (a campaign adviser), and Jason Miller (Campaign spokesman). As 
discussed further below, Stone made a number of public references to WikiLeaks, Julian 
Assange, and the release of DNC-related emails. 

B, The DNC Email Hack and Russia’s Use of “Guccifer 2.0” and WikiLeaks to 

Disseminate Hacked Information. 

10. According to the public and unclassified intelligence report prepared by the 
United States Intelligence Community, Russian intelligence gained access to the Democratic 
National Committee (DNC) networks in July 2015 and maintained that access until at least June 
2016. By March 2016, the Russian military intelligence (General Staff Main Intelligence 
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Directorate or “GRU”) probably began cyber operations aimed at the U.S. election. The GRU 
operations resulted in the compromise of personal e-mail accounts within the DNC and other 
Democratic Party officials and political figures. By in or about May 2016, the GRU had 
exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South 
Capitol Street SE, Washington, D.C. 20003. 

11. The public and unclassified intelligence report assessed that: 

a. The GRU used a Twitter account, “Guccifer 2.0” and the website 
DCLeaks.com to release the U.S. victim data obtained in cyber operations publicly and in 
exclusives to media outlets and relayed material to WikiLeaks. 

b. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his likely Russian identity 
throughout the election. 

c. Content that was taken from e-mail accounts targeted by the GRU in 
March 2016 appeared on DCLeaks.com starting in June 2016. 

d. The GRU relayed material it acquired from the DNC and senior 
Democratic officials to WikiLeaks. WikiLeaks was mostly likely chosen because of its 
self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not 
contain any evident forgeries. 

e. The Kremlin’s principal international propaganda outlet RT (formerly 
Russia Today) has actively collaborated with WikiLeaks. RT’s editor-in-chief visited 
WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London in August 
2013, where they discussed renewing his broadcast contract with RT, according to 
Russian and Western media. Russian media has subsequently announced that RT had 
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become “the only Russian media company” to partner with WikiLeaks and had received 
access to “new leaks of secret information.” 

f. On or about August 6, 2016, RT published an English-language video 
called “Julian Assange Special: Do WikiLeaks Have the E-Mail That’ll Put Clinton in 
Prison?” and an exclusive interview with Assange entitled “Clinton and ISIS Funded by 
the Same Money.” 

12. On or about June 14, 2016, the Washington Post reported that “Russian 
government hackers” had penetrated the DNC computer network and stole opposition research 
on Donald J. Trump. The Kremlin’s spokesman denied any Russian involvement in the hack. 

13. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack 
and began posting hacked documents. 

14. As detailed further below, on or about June 22, 2016, Guccifer 2.0 and Target 
Account 1 initiated communication via Twitter private messaging regarding the transfer and 
release of hacked information, including the hacked email accounts related to the DNC. 

15. On or about July 22, 2016, WikiLeaks published about 20,000 emails stolen from 
the DNC. Using Target Account 1, WikiLeaks publicly tweeted: “WikiLeaks releases thousands 
of documents about Clinton and internal deliberations” and linked to a Washington Post article 
and www.wikileaks.org/dnc-emails/. 

16. On or about August 12, 2016, Guccifer 2.0 released personal cellphone numbers 
and email addresses from the files of the Democratic Congressional Campaign Committee 
(DCCC). 

17. On or about August 21,2016, Roger Stone directed a publicly-available tweet at 
John Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon 


6 


Case l:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 8 of 31 


the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a ‘“mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, 1 think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

18. On or about September 13, 2016, Target Account 1 tweeted a public message 
stating, “678.4 MB of new ‘DNC documents’ from @Guccifer_2,” with a link to a publicly 
available file. 

19. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

2Q. Approximately a half hour later, at 4:32 P.M., Target Account 1 sent out a Tweet 
reading “RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing 
a link to approximately 2,050 emails that had been hacked from John Podesta’s personal email 
account. WikiLeaks, via Target Account 1, continued to release John Podesta’s hacked emails 
throughout October 10-14, 2016. 

C. Communications Between the Target Account 1 and Guccifer 2.0 

21. On July 7, 2017 Magistrate Judge Maria-Elena James of the Northern District of 

California issued a search warrant for the Twitter Account associated with Guccifer 2.0. The 
communications obtained from the account are detailed further below. 
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22. On or about June 22, 2016, WikiLeaks sent Guccifer 2.0 sent a direct message 
(DM) stating “Do you have secure communications?” Target Account 1 stated, “Send any new 
material here for us to review and it will have a much higher impact than what you are doing. No 
other media will release the full material.” Guccifer 2.0 replied, “what can u suggest for a secure 
connection? Soft, keys, etc? I’m ready to cooperate with you, but I need to know what’s in your 
archive 80gb? Are there only HRC emails? Or some other docs? Are there any DNC docs? If it’s 
not secret when you are going to release it?” Target Account 1 wrote back, “You can send us a 
message in a .txt file here,” and attached a web link. Guccifer 2.0 responded, “do you have 
GPG?” I know from my training and experience that “GPG” refers to a program for exchanged 
encrypted information. 

23. On or about June 24, 2016, Guccifer 2.0 wrote to Target Account 1, “How can 
we chat? Do u have jabber or something like that?” I know from my training and experience that 
“Jabber” is an instant messaging service. Target Account 1 wrote back, “Yes, we have 
everything. We’ve been busy celebrating Brexit. You can also email an encrypted message to 
office@wikiIeaks.org. They key is here.” 1 A web link was attached to the message. I know from 
my training and experience that an encryption “key” is a string of information created for 
scrambling and unscrambling data. 

24. On or about June 27, 2016, Guccifer 2.0 wrote to Target Account 1, “Hi, [I]’ve 
just sent you an email with a text message encrypted and an open key.” Target Account 1 wrote 
back, “Thanks.” Guccifer 2.0 replied, “waiting for ur response. I send u some interesting piece.” 


'Target Account 1 sent each sentence as a separate message, though close in time. These messages have been 
consolidated into a single quote for ease of reading. The same is done below with other close in time messages. 


8 



Case l:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 10 of 31 


25. On or about July 4, 2016, Guccifer 2.0 wrote to Target Account 1, “hi there, 
check up r email, waiting for [r]eply.” 

26. On or about July 6, 20 1 6, Guccifer 2.0 wrote to Target Account 1 , “have u 
received my parcel?” Target Account 1 responded, “Not unless it was very recent, [we haven’t 
checked in 24h].” 2 Guccifer 2.0 replied, “I sent it yesterday, an archive of about 1 gb. via 
[website link]. [A]nd check your email.” Target Account 1 wrote back, “Wil[l] check, thanks.” 
Guccifer 2.0 responded, “let me know the results.” Target Account 1 wrote back, “Please don’t 
make anything you send to us public. It’s a lot of work to go through it and the impact is severely 
reduced if we are not the first to publish.” Guccifer 2.0 replied, “agreed. How much time will it 
take?” Target Account 1 responded, “likely sometime today.” Guccifer 2.0 wrote back, “will u 
announce a publication? and what about 3 docs [I] sent u earlier?” Target Account 1 responded, 
“I don’t believe we received them. Nothing on ‘Brexit’ for example.” Guccifer 2.0 wrote back, 
“wow. have you checked ur mail?” Target Account 1 replied, “At least not as of 4 days ago.... 
For security reasons mail cannot be checked for some hours.” Guccifer 2.0 wrote back, “fuck, [I] 
sent 4 docs on brexit on jun 29, an afehive in gpg[.] ur submission form is too fucking slow, [1] 
spent the whole day uploading 1 gb.” I know from my training and experience that the term “gb” 
is an abbreviation for “gigabyte,” a unit of measurement of information stored on a computer. 

27. Target Account 1 wrote back, “We can arrange servers lOOx as fast. The speed 
restrictions are to anonymise the path. Just ask for custom fast upload point in an email.” 
Guccifer 2.0 wrote, “will u be able to check ur email?” Target Account 1 responded, “We’re 
best with very large data sets. e.g. 200gb. these prove themselves since they’re too big to fake.” 


2 The brackets appear in the original message. 
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Guccifer 2.0 responded, “or shall I send brexit docs via submission once again?” Target 
Account 1 responded, “to be safe, send via [web link].” 

28. On or about that same day, Guccifer 2.0 wrote, “can u confirm u received dnc 
emails?” Target Account 1 wrote back several messages later, “for security reasons we can’t 
confirm what we’ve received here, e.g., in case your account has been taken over by us 
intelligence and is probing to see what we have.” Guccifer 2.0 responded, “then send me an 
encrypted email.” Target Account 1 wrote back, “we can do that, but the security people are in 
another time zone so it will need to wait some hours.” Target Account 1 wrote, “what do you 
think about the FBI’s failure to charge? To our mind the clinton foundation investigation has 
always been the more serious, we would be very interested in all the emails/docs from there. She 
set up quite a lot of front companies, e.g in Sweden.” Guccifer 2.0 responded, “ok, [I]’ll be 
waiting for confirmation. [A]s for investigation, they have everything settled, or else I don’t 
know how to explain that they found a hundred classified docs but fail to charge her.” Target 
Account 1 responded, “She’s too powerful to charge at least without something stronger. [A]s 
far as we know, the investigation into the clinton foundation remains open[.] [W]e hear the FBI 
are unhappy with Loretta Lynch over meeting Bill, because he’s a target in that investigation.” 

29. On or about that same day, Guccifer 2.0 wrote to Target Account 1, “[D]o you 
have any info about marcel lazar? There’ve been a lot of rumors of late.” “Marcel Lazar” is the 
name of a Romanian Hacker who used the pseudonym “Guccifer,” and who pled guilty on May 
25, 2016 in the Eastern District of Virginia to hacking the personal accounts of a variety of 
victims, including a former U.S. president. According to publicly available reporting, in May 
2016, Lazar also claimed to have hacked the email served belonging to then-candidate Clinton. 
Lazar stated, “For me, it was easy ... easy for me, for everybody.” Lazar’s claims have not been 
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substantiated, and the undersigned is not aware of evidence indicating Lazar accomplished the 
hack. 

30. Target Account 1 wrote back, “the death? [A] fake story.” Target Account 1 
messaged: “His 2013 screen shots of Max Blumenthal’s inbox prove that Hillary secretly deleted 
at least one email about Libya that was meant to be handed over to Congress. So we were very 
interested in his co-operation with the FBI.” Guccifer 2.0 wrote back, “some dirty games behind 
the scenes [I] believe[.] Can you send me an email now?” Target Account 1 wrote back, “No; 
we have not been able to activate the people who handle it. Still trying.” Guccifer 2.0 replied, 
“what about tor submission? [W]ill u receive a doc now?” Target Account 1 replied, “We will 
get everything sent on [weblink].” [A]s long as you see V’upload succseful\” at the end. [I]f you 
have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the 
DNC is approaching and she will solidify bernie supporters behind her after.” Guccifer 2.0 
responded, “ok. I see.” 

31. Target Account 1 wrote, “[W]e think the public interest is greatest now and in 
early October.” Guccifer 2.0 responded, “do u think a lot of people will attend bernie fans rally in 
philly? Will it affect the dnc anyhow?” Target Account 1 wrote, “bernie is trying to make his 
own faction leading up to the DNC. [S]o he can push for concessions (positions/policies) or, at 
the outside, if hillary has a stroke, is arrested etc, he can take over the nomination. [T]he question 
is this: can bemies supporters+staff keep their coherency until then (and after). [0]r will they 
dis[s]olve into hillary’s camp? [Presently many of them are looking to damage hilary [sic] 
inorder [sic] to increase their unity and bargaining power at the DNC. Doubt one rally is going to 
be that significant in the bigger scheme. [I]t seems many of them will vote for hillary just to 
prevent trump from winning.” 
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32. On or about that same day, Guccifer 2.0 sent Target Account 1 a message 
reading, “sent brexit docs successfully.” Target Account 1 responded, “:))).” Target Account 1 
wrote back, “we think trump has only about a 25% chance of winning against hillary so conflict 
between bernie and hillary is interesting.” Guccifer 2.0 responded, “so it is.” Target Account 1 
wrote, “also, it’s important to consider what type of president hillary might be. If bernie and 
trump retain their groups past 2016 in significant number, then they are a restraining force on 
hillary.” 

33. On or about July 7, 2016, Target Account 1 wrote, “All good?” Guccifer 2.0 
responded, “yeah, what about u? is smth wrong?” I know from my training and experience that 
“smth” is used as an abbreviation for “something.” Target Account 1 wrote back, “No. All 
good.” Guccifer 2.0 wrote back, “are working with the emails [1] sent u? [C]heck ur email. [I] 
sent u a check archive from another email box. fuck, mail undelivered. [D]o you have another 
way to receive large volumes of data? [B]esides for tor submission form?” 

34. On or about July 11,2016, Guccifer 2.0 wrote to Target Account 1, “sent it via 
ur submission, check it.” 

35. On or about July 13, 2016, Guccifer 2.0 wrote, “r u there?” On or about July 14, 
2016, Guccifer 2.0 wrote, “ping. Check ur email, sent u a link to a big archive and a pass.” 
Target Account 1 replied, “great, thanks: can’t check until tomorrow though.” 

36. On or about July 17, 2016, Guccifer 2.0 wrote, “what bout now?” On or about 
July 18, 2016, Target Account 1 responded, “have the 1Gb or so archive.” Guccifer 2.0 
responded, “have u managed to extract the files?” Target Account 1 responded, “yes. turkey 
coup has delayed us a couple of days. [Otherwise all ready[.]” Guccifer 2.0 responded, “so 
when r u about to make a release?” Target Account 1 wrote back, “this week. [D]o you have 
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any bigger datasets? [D]id you get our fast transfer details?” Guccifer 2.0 wrote back, “i’ll check 
it. did u send it via email? Target Account 1 responded, “yes.” Guccifer 2.0 replied, “to [web 
link]. [I] got nothing.” Target Account 1 wrote, “check your other mail? this was over a week 
ago.” Guccifer 2.0 wrote back, “oh, that one, yeah, [I] got it.” 

37. On or about July 18, 2016, Target Account 1 wrote, “great. [D]id it work?” 
Guccifer 2.0 wrote back, “[I] haven’t tried yet.” Target Account 1 responded, “Oh. We arranged 
that server just for that purpose. Nothing bigger?” Guccifer 2.0 wrote back, “let’s move step by 
step, u have released nothing of what [I] sent u yet.” Target Account 1 replied, “How about you 
transfer it all to us encrypted. [T]hen when you are happy, you give us the decrypt key. [T]his 
way we can move much faster. [A] Iso it is protective for you if we already have everything 
because then there is no point in trying to shut you up.” Guccifer 2.0 wrote back, “ok, i’ll ponder 
it.” 

D. Contacts Involving the Julian Assange, Roger Stone, and the Target Accounts 

38. Approximately eight days after the last communication between Guccifer 2.0 and 
WikiLeaks described above, on or about July 25, 2016, Stone sent an email to Jerome Corsi, an 
author and political commentator, with the subject line, “Get to Assange.” 3 The body of the 
message read: “Get to Assange [a]t Ecuadorian Embassy in London and get the pending 
wikileaks emails...they deal with Foundation, allegedly.” 

39. On or about August 2, 2016, Corsi emailed Stone, “Word is friend in embassy 
plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging 

3 1. On August 7, 2017, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for 

Roger Stone’s Twitter account, @RogerJStoneJr. On September 11, 2017, Chief Judge Beryl A. Howell of the 
District of Columbia issued a search warrant for Stone’s Hotmail address, The relvant 

results of those search warrants are summarized in the paragraphs which follow. 
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.. .Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop 
HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting 
HRC old, memory bad, has stroke — neither he nor she well. I expect that much of next dump 
focus, setting stage for Foundation debacle.” Based on my training, experience, and review of 
materials in this case, it appears that Corsi’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to Julian Assange (the user of Target Account 2), the founder of 
WikiLeaks, who resided in Ecuador’s London Embassy in 2016. 

40. On or about August 16, 2016, Corsi emailed Stone a link to a piece Corsi had 
written about Stone titled, “Trump Adviser: Wikileaks Plotting Email Dump to Derail Hillary.” 

41. As discussed above, on or about August 21,2016, Roger Stone directed a 
publicly-available tweet at John Podesta, Hillary Clinton’s presidential campaign manager, 
stating: “Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” 

42. On or about August 31,2016, Corsi emailed Stone: “Did you get the PODESTA 
write-up.” STONE replied “Yes.” 

43. On or about September 6, 2016, Corsi emailed: “Roger[,] Is NY Post going to use 
the Pedesta [sic] stuff?” 

44. On or about October 7, 2016, WikiLeaks began releasing emails hacked from 
John Podesta’s account. 

45. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta argued publicly that “[it is] a reasonable 
assumption to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the 
release of his emails] and the Trump campaign had advanced warning about what Assange was 
going to do. 1 think there’s at least a reasonable belief that [Assange] may have passed this 
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information on to [Stone].” Commenting to the Miami Herald on or about that same date, Stone 
responded: “1 have never met or spoken with Assange, we have a mutual friend who’s traveled to 
London several times, and everything 1 know is through that channel of communications. I’m not 
implying I have any influence with him or that I have advanced knowledge of the specifics of 
what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, 
the Clinton aides, thought were deleted. I hear that through my emissary.” 

46. On or about that same day, October 12, 2016, Corsi emailed Stone on both the 
with a subject line “Podesta talking points.” Attached to the email was a file labeled, “ROGER 
STONE podesta talking points Oct 12 2016.docx.” The “talking points” included the statement 
that, “Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” Corsi followed 
up several minutes later with another email titled, “Podesta talking points,” with the text “sent a 
second time just to be sure you go it.” Stone emailed Corsi back, “Got them and used them.” 

47. On or about the next day, October 13, 2016, Stone sent a private direct message to 
Target Account 1 stating, “Since I was all over national TV, cable and print defending 
wikileaks and assange against the claim that you are Russian agents and debunking the false 
charges of sexual assault as trumped up bs you may want to rexamine the strategy of attacking 
me- cordially R.” Target Account 1 responded, “We appreciate that. However, the false claims 
of association are being used by the democrats to undermine the impact of our publications. 

Don't go there if you don't want us to correct you.” 

48. On or about October 16, 2016, Roger Stone wrote to Target Account 1, “Ha! The 
more you Y'correctY' me the more people think you're lying. Your operation leaks like a sieve. 
You need to figure out who your friends are.” 
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49. On or about October 17, 2016, Corsi emailed Stone with the subject, “Fwd: 
ASSANGE...URGENT...” Corsi wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yesf.J I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is he has a set of dead man files that include Hillary. It’s 
what they used to call a ‘Mexican stand off[.]’ Only hope is if Trump speaks out to save him[.] 
Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can kiss his 
life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and raised him 
the election.” 

50. The presidential election was held on November 8, 2016. 

51. On or about November 9, 2016, Target Account 1 messaged Roger Stone, 
“Happy?” and then wrote, “We are now more free to communicate.” 

52. On or about March 27, 2017, Target Account 1 wrote to Roger Stone, “FYI, 
while we continue to be unhappy about false V'back channelY’ claims, today CNN deliberately 
broke our off the record comments.” 

53. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since 1 never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 
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54. On or about April 7, 2017, Roger Stone wrote to Target Account 1, “I am JA's 
only hope for a pardon the chances of which are actually (weirdly) enhanced by the bombing in 
Syria (which 1 opposed) . You have no idea how much your operation leaks. Discrediting me 
only hurts you. Why not consider saying nothing? PS- Why would anyone listen to that asshole 
Daniel Ellsberg.” Based on my training, experience, and review of materials in this case, 1 
believe that “JA” refers to Julian Assange, the user of Target Account 2. 

55. On or about April 19, 2017, Assange, using Target Account 2, wrote to Stone, 
“Ace article in infowars. Appreciated. But note that U.S. intel is engages in slight of hand 
maoevers [sic]. Listen closely and you see they only claim that we received U.S. election leaks 
V'not directlyY' or via a Y'third partyY and do not know V'whenV etc. This line is Pompeo appears 
to be getting at with his Y'abbetedY’. This correspnds to the same as all media and they do not 
make any allegation that WL or I am a Russia asset.” 

56. On or about June 4, 2017, Roger Stone wrote back to Target Account 2, “Still 
nonsense. As a journalist it doesn't matter where you get information only that it is accurate and 
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen 
from the government and the courts ruled it was legal to do so and refused to issue an order 
restraining the paper from publishing additional articles. If the US government moves on you I 
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I 
don't know of any crime you need to be pardoned for - best regards. R.” Target Account 2 
responded, “Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most 
strongly from those obsessed with taking down Trump trying to squeeze us into a deal.” 

57. On or about June 10, 2017, Roger Stone wrote to Target Account 2, “I am doing 
everything possible to address the issues at the highest level of Government. Fed treatment of 
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you and Wikileaks is an outrage. Must be circumspect in this forum as experience demonstrates 
it is monitored. Best regards R.” Target Account 2 wrote back, “Appreciated. Of course it is!” 

E. Target Account 1 Sends the “Guessed” Password to to 

58. During the events described above, Target Account 1 also engaged in a separate 

proviate conversation regarding a “guessed” password to the non-public website 
“PutinTrump.org.” On or about September 20, 2016, at approximately 9:07PM, Target Account 
1 publicly tweeted, ‘“Let’s bomb Iraq’ Progress for America PAC to launch ‘PutinTrump.org’ at 
9:30am. Oops pw is putintrump.org.” 

59. On or about September 20, 2016, at approximately 11:59PM, Target Account 1 

sent a private message to a high level individual associated with the Campaign (the “high-level 
Campaign individual”). 4 The message stated: “A PAC run anti-Trump site is 

about to launch. The PAC is a recycled pro-Iraq war PAC. We have guessed the password. It is 

• See ‘About’ for who is behind it. Any comments?” 

60. According to publicly available reporting, at approximately 9:31 AM on or about 

September 21, 2016, the website was launched. The website was run by 

individuals who stated they wanted to focus attention to what they described as the “dangerous 
and unprecedented ties” between Vladimir Putin and Donald J. Trump. 

61. On or about September 21, 2016, at approximately 11:50AM (approximately two 
hours after PutinTrump.org went “live” according to publicly available press accounts), the high- 


4 These records were obtained via a search warrant signed by Chief Judge Beryl A. Howell of the District of 
Columbia on October 12,2017. 
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level Campaign individual sent Target Account 1 a private message: “Off the record 1 don’t 
know who that is but I’ll ask around. Thanks.” 

INFORMATION CONCERNING TWITTER 

62. Twitter owns and operates a free-access social-networking website of the same 
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users to create and read 140-character messages called 
“Tweets,” and to restrict their “Tweets” to individuals whom they approve. These features are 
described in more detail below. 

63. Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

64. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

65. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her 
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account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

66. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 

67. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 
account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

68. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

69. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

70. When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 
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71. A Twitter user can '‘follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user ( i.e ., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

72. In addition to posting Tweets, a Twitter user can also send DMs to one of his or 
her followers. These messages are typically visible only to the sender and the recipient, and both 
the sender and the recipient have the power to delete the message from the inboxes of both users. 
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs 
are stored on Twitter’s database. 

73. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

74. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 
25 past searches. 
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75. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 

76. If a Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 

77. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

78. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter account activity can show how and when the account was accessed or 
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used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

79. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other 
account information. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

80. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Twitter to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A and 
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particularly described in Section I of Attachment B. Upon receipt of the information described in 
Section I of Attachment B, government-authorized persons will review that information to locate 
the items described in Section II of Attachment B. 

CONCLUSION 

81. Based on the forgoing, I request that the Court issue the proposed search warrant. 

82. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

83. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 





rson 


Amy Ar 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on 


this^ 


A 

_ day of November, 2017. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to Be Searched 

All information that is associated with the Twitter profile with usernames from the period 
from July 1,2015 to the present: 

@Wikileaks (twitter.com/wikileaks) (Target Account 1) 

@JulianAssange (twitter.com/JulianAssange) (Target Account 2) 
that is stored at premises owned, maintained, controlled, or operated by Twitter, a company 
headquartered in San Francisco, California. 
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ATTACHMENT B 
Particular Things to be Seized 
I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, including any messages, records, files, logs, or information that 
have been deleted but are still available to Twitter, or have been preserved pursuant to a request 
made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the 
government for each account listed in Attachment A: 

a. All identity and contact information, including full name, e-mail address, physical 
address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers; 

b. All past and current usernames, account passwords, and names associated with 
the account; 

c. The dates and times at which the account and profile were created, and the 
Internet Protocol (“IP”) address at the time of sign-up; 

d. All IP logs and other documents showing the IP address, date, and time of each 
login to the account; 

e. All data and information associated with the profile page, including photographs, 
“bios,” and profile backgrounds and themes; 

f. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the 
account, and all photographs or images included in those Tweets and Direct 
Messages; 
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g. All information from the “Connect” tab for the account, including all lists of 
Twitter users who have favorited or retweeted Tweets posted by the account, as 
well as a list of all Tweets that include the username associated with the account 
(i.e., “mentions” or “replies”); 

h. All photographs and images in the user gallery for the account; 

i. All location data associated with the account, including all information collected 
by the “Tweet With Location” service; 

j. All information about the account’s use of Twitter’s link service, including all 
longer website links that were shortened by the service, all resulting shortened 
links, and all information about the number of times that a link posted by the 
account was clicked; 

k. All data and information that has been deleted by the user; 

l. A list of all of the people that the user follows on Twitter and all people who are 
following the user (i.e., the user’s “following” list and “followers” list); 

m. A list of all users that the account has “unfollowed” or blocked; 

n. All “lists” created by the account; 

o. All infonnation on the “Who to Follow” list for the account; 

p. All privacy and account settings; 

q. All records of Twitter searches performed by the account, including all past 
searches saved by the account; 

r. All information about connections between the account and third-party websites 
and applications; 
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s. All records pertaining to communications between Twitter and any person 

regarding the user or the user’s Twitter account, including contacts with support 
services, and all records of actions taken, including suspensions of the account. 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and 
instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection 
with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to 
commit an offense against the United States), and 18 U.S.C. § 2 (aiding and abetting) since 
March 1,2016 including, for each user ID identified on Attachment A, information pertaining to 
the following matters: 

a. Any correspondence regarding hacked emails or other data from: 

i. the Democratic National Committee (DNC) 

ii. the email belonging to John Podesta (“the email hack”) 

iii. any other individual related to the 2016 United States election. 

b. Any communications between the Target Accounts and individuals 
associated with the DNC email hack; 

c. Any communications indicating any advance knowledge or direction, 
planning, or control of the email hack; 

d. Any communications related to the website PutinTrump.Org. 

e. Evidence indicating how and when the Twitter account was accessed or used, 
to determine the chronological and geographic context of account access, use, 
and events relating to the crime under investigation and to the Twitter account 
owner; 

f. Evidence indicating the Twitter account owner’s state of mind as it relates to 
the crime under investigation; 
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g. The identity of the person(s) who created or used the user ID, including 
records that help reveal the whereabouts of such person(s). 

h. The identity of the person(s) who communicated with the accounts about 
matters related to 18 U.S.C. § 1030, including records that help reveal their 
whereabouts. 
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AO 93 (Rev 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

| Case: 1:17-mj-00982 

) Assigned To : Howell, Beryl A. 

) Assign. Date : 12/19/2017 

) Description: Search and Seizure Warrant 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern_ District of ___ California 

(identify the person or describe the property to be searched and give its location)’. 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 



See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _January 2, 2018 (not to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to__ Hon. Be ryl A. Howell ,_- 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _____ ____ * 


Date and time issued: 



ff /h 



Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: 


Washington, DC 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


1 declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: ____. _-_-_- 

Executing officer's signature 


Printed name and title 
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AO 106 (Rev 04/10) Application for a Search Warrant 


United States District Court 

for the 

District of Columbia 


fTT 8 ET r, 

- 

DEC 1 9 2017 

cS f & Bankruptcy 

Courts 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 



> 

) 

) 

) 

) 

) 


Case: 1:17-mj-00982 
Assigned To : Howell, Beryl A. 

Assign. Date : 12/19/2017 
Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officeror an attorney for the government, request a search warrant and slate under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A. 

located in the Northern District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B. 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

Sf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section 
18 U.S.C. § 1030 
18 U.S.C. §371; 2 
52 U.S.C. §30121 


Offense Description 

Fraud and related activities in connection with computers 
Conspiracy against the United States; Aiding and abetting 
Foreign contribution ban 


The application is based on these facts: 


See attached Affidavit. 


lyf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: _ ) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 


lAaron Zelinsky (ASC) 



Applicant's signature 

Amy Anderson, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 
Date: 12/19/2017 


Judge’s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and title 
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FILED 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT of mt ttmrta 


DEC 1 9 2017 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 


Clerk, U.S. District 6 SamtfUBfew 
Case: 1:17-mj-00982°urt« forttic Dletnetof' sM'm&ia 
Assigned To : Howell, Beryl A. 

Assign. Date : 12/19/2017 
Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Amy A. Anderson, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with the following email account (hereafter the Target Account), 
described in more detail in Attachments A and B: 

• “Target Account”) an email address associated 

with described further in Attachment A, maintained by 

Google; 

The information to be disclosed by Google (hereafter “the Provider”) and searched by the 
government is described in the following paragraphs and in Attachments A and B. This affidavit 
is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 
2703(b)(1)(A), and 2703(c)(1)(A). 

2. I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working directly with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2010. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 
experience related to espionage and foreign intelligence services national security investigations. 
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I have conducted and participated in various investigations involving multiple threat countries as 
well as national security threats and applicable criminal violations. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains communications relevant to 
violations of 18 U.S.C. § 1030 (fraud and related activities in connection with computers), 52 
U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to commit an offense 
against the United States), and 18 U.S.C. § 2 (aiding and abetting). 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court). . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 11. 

SUMMARY 

6. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get to 

Assange” in person at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” On or 
about August 1, 2016, STONE also instructed CORSI to have (the user of 

the Target Account) contact Julian ASSANGE. On or about August 2, 2016, CORSI responded 
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to STONE that the “word is friend in embassy [ASSANGE] plans 2 more dumps. One shortly 
after Em back. 2nd in October. Impact planned to be. very damaging.... Time to let Podesta to be 
exposed as in bed w enemy if they are not ready to drop HRC.” Information disclosures 
subsequently occurred on or about the times CORSI predicted: On or about August 12, 2016, the 
day CORSI was scheduled to return to the United States (“shortly after I’m back”), Guccifer 2.0 
released hacked information related to the Democratic Congressional Campaign Committee 
(DCCC). On October 7, 2016 (“in October”), WikiLeaks began releasing emails hacked from 
John Podesta’s email account. 

7. On or about November 13, 2016, using the Target Account, 

emailed Stone to congratulate him on “takfing] the country back,” and stating, “You deserve a 
lot of credit and working with you and Jeri Corsi, who is with me now in London has been a 
great joy.” On or about January 7, 2017, using the Target Account emailed 

recipients about John Podesta going “phishing.” 

PROBABLE CAUSE . 

A. Background on Relevant Individuals 
i. Roger STONE 

8. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
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Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 

ii. Jerome CORSI 

9. Jerome CORSI is a political commentator who, according to publicly available 
information, serves as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 

iii. 


10. 
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B. Disclosure of Hacked Information by WikiLeaks During the 2016 Presidential 
Campaign 


11. According to the public and unclassified intelligence report prepared by the 
United States Intelligence Community, Russian intelligence gained access to the Democratic 
National Committee (DNC) networks in July 2015 and maintained that access until at least June 
2016. By March 2016, the Russian military intelligence (General Staff Main Intelligence 
Directorate or “GRU”) probably began cyber operations aimed at the U.S. election. The GRU 
operations resulted in the compromise of personal e-mail accounts within the DNC and other 
Democratic Party officials and political figures. By in or about May 2016, the GRU had 
exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South 
Capitol Street SE, Washington, D.C. 20003. 

12. The public and unclassified intelligence report assessed that: 

a. The GRU used a Twitter account, “Guccifer 2.0” and the website 
DCLeaks.com to release the U.S. victim data obtained in cyber operations publicly and in 
exclusives to media outlets and relayed material to WikiLeaks. 

b. Guccifer 2.0, who claimed to be an independent Romanian,hacker, made 
multiple contradictory statements and false claims about his likely Russian identity 
throughout the election. 

c. Content that was taken from e-mail accounts targeted by the GRU in 
March 2016 appeared on DCLeaks.com starting in June 2016. 
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d. The GRU relayed material it acquired from the DNC and senior 
Democratic officials to WikiLeaks. WikiLeaks was mostly likely chosen because of its 
self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not 
contain any evident forgeries. 

e. The Kremlin’s principal international propaganda outlet RT (formerly 
Russia Today) has actively collaborated with WikiLeaks. RT’s editor-in-chief visited 
WikiLeaks founder Julian ASSANGE at the Ecuadorian Embassy in London in August 
2013, where they discussed renewing his broadcast contract with RT, according to 
Russian and Western media. Russian media has subsequently announced that RT had 
become “the only Russian media company” to partner with WikiLeaks and had received 
access to “new leaks of secret information.” 

13. On or about June 14,2016, the Washington Post reported that “Russian 
government hackers” had penetrated the DNC computer network and stole opposition research 
on Donald J. Trump. The Kremlin’s spokesman denied any Russian involvement in the hack. 

14. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack 
and began posting hacked documents. 

15. On or about July 22, 2016, WikiLeaks published about 20,000 emails stolen from 
the DNC. 

16. On or about August 12, 2016, Guccifer 2.0 released personal cellphone numbers 
and email addresses from the files of the Democratic Congressional Campaign Committee 
(DCCC). 

17. On or about August 21,2016, Roger STONE sent a publicly-available tweet 
referring to John Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it 
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will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that 
same day, Stone reiterated that because of the work of a “‘mutual acquaintance’-of both his and 
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

18. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

19. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent out a public Tweet 
reading “RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing 
a link to approximately 2,050 emails that had been hacked from John Podesta’s personal email 
account. WikiLeaks continued to release John Podesta’s hacked emails throughout October 10- 
14, 2016. 

C. Roger STONE’s Private Twitter Messages with Guccifer 2.0, WikiLeaks, and Julian 

ASSANGE. 

20. As discussed above, on or about July 22, 2016, WikiLeaks published 
approximately 20,000 emails stolen from the DNC. 

21. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” 
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22. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

23. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

24. On August 14, 2016, Stone sent a private message on Twitter using 
@RogerJStoneJr to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle 
reinstated after having been suspended. 1 

25. On August 15, 2016, Guccifer 2.0 replied to Stone at @RogerJStoneJr, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 
interesting in the docs I posted.” 

26. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking 
Guccifer to retweet an article he had written regarding the ‘rigg[ing]’ of the 2016 presidential 
elections. 

27. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

28. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 

1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account 
@RogerJStoneJr. 
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Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

29. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” 

30. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

31. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

32. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of WikiLeaks’ 10-year anniversary celebration - Stone told Info wars that his 
intermediary described this release as the “mother load.” 

33. On Tuesday, October 4, 2016, Stone used @RogerJStoneJr to tweet: “Payload 
coming. #Lockthemup.” 

34. As discussed above, on Friday, October 7, 2016, WikiLeaks began to release 
emails that had been hacked from John Podesta’s personal email account. 

35. On or about October 12, 2016, John Podesta - referring back to Stone’s August 
21, 2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption 
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
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think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

36. On or about the next day, October 13, 2016, @RogerJStoneJr sent a private direct 
message to the Twitter account @WikiLeaks. The message read: “Since I was all over national 
TV, cable and print defending WikiLeaks and assange against the claim that you are Russian 
agents and debunking the false charges of sexual assault as trumped up bs you may want to 
rexamine the strategy of attacking me- cordially R.” Less than an hour later, @wikileaks 
responded by direct message: “We appreciate that. However, the false claims of association are 
being used by the democrats to undermine the impact of our publications. Don't go there if you 
don't want us to correct you.” 

37. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you Y'correctV me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 

38. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 
communicate.” 
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39. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

40. On or about March 27, 2017, CNN reported that a representative of WikiLeaks, 
writing from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

41. On or about June 4,2017, @RogerJStoneJr directly messaged @JulianAssange, 
an address associated with Julian Assange in numerous public reports, stating: “Still nonsense. 

As a journalist it doesn't matter where you get information only that it is accurate and authentic. 
The New York Times printed the Pentagon Papers which were indisputably stolen from the 
government and the courts ruled it was legal to do so and refused to issue an order restraining the 
paper from publishing additional articles. If the US government moves on you I will bring down 
the entire house of cards. With the trumped-up sexual assault charges dropped I don't know of 
any crime you need to be pardoned for - best regards. R.” That same day, @JulianAssange 
responded: “Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most 
strongly from those obsessed with taking down Trump trying to squeeze us into a deal.” 
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42. On or about June 10, 2017, @RogerJStoneJr sent a direct message to @wikileaks, 
reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

D. Roger STONE’S Emails with Jerome COKS1 and 

43. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 

issued a search warrant for STONG’s ^^^Jl address, Emails 

recovered pursuant to that search warrant indicated the following: 

44. On or about June 20, 2016,^^^^^!, using the Target Account, emailed 

STONE and Paul MANAFORT, the Campaign Chairman, asking to “know immediately how I 
can help” the Campaign. also wrote that his “research on Rhodes House” was 

nearing completion. The “Rhodes House” research appears to be a reference to STONE’s 
previous tweet on or about October 13, 2015 that, “In 1969, Bill Clinton was expelled from 
Oxford for raping nineteen-year-old Rhodes House is the headquarters of the 

Rhodes Trust, and STONE mentioned a § ain t0 a montltl later > as 

discussed below. 

45. On or about July 7, 2016, using the Target Account, emailed Stone 

that he had “my tickets to Cleveland[.] [D]o you have my credential pack?” appears 

to be referencing the Republican National Convention held in Cleveland. 

46. On or about July 25, 2016,^^^^^, using the Target Account, forwarded 

an email to STONE and CORSI with the subject line: “Fwd: The Bill Gates of Turkey wants to 
create a campaign for Donald J Trump in Turkey.” wrote: “Do you want to have a 

talk about this? Turkey is for Trump!” Below was a forwarded message sent to the Target 
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Account from an individual who stated that he had been contacted by the “Bill Gates of Turkey, 
in regards to creating a robust campaign for Mr Donald J Trump.” 

47. On or about that same day, July 25, 2016, (approximately three days after 

WikiLeaks began releasing emails hacked from the DNC), emailed Roger 

STONE with the subject line, “You need to get to Assange.” The body of the message read: “At 
Ecuadorian Embassy in London and get the pending wikileaks emails...they deal with 
Foundation, allegedly.” 

48. According to records ^^^^B ^B approximately ninety 

minutes later STONE called CORSI and they spoke for 26 minutes. 

49. Less than two hours after the phone call to CORSI, STONE emailed CORSI at 
with the subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t 
Ecuadorian Embassy in London and get pending WikiLeaks emails.. .they deal with Foundation, 
allegedly.” It appears that STONE cut and pasted the email from ^^^B' t0 CORSI. 

50. On or about July 27, 2016, then-candidate Donald Trump stated in a press 
conference, “Russia, if you are listening, I hope you’re able to find the 30,000 [Hillary Clinton] 
emails that are missing. I think you will probably be rewarded mightily by our press. Let’s see if 
that happens. That will be next.” 

51. On or about July 28, 2016, Roger STONE called Richard GATES (then the 
deputy-chair of the Campaign). The two spoke for approximately twelve minutes. 

52. On or about July 30, 2016, Paul MANAFORT (then the Chairman of the 
Campaign) called STONE. The two spoke for approximately one hour and seven minutes. The 
Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven 
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minutes is the longest call (by almost a half-hour) that took place between STONE and 
MANAFORT in this time period. 

53. On or about July 31, 2016, STONE called GATES and the two spoke for 

approximately 5 minutes. Approximately ninety minutes later, STONE emailed CORSI at with 
the subject line, “Call me MON.” The Body read: should see Assange[.] 

should find Bemie sanders brother who called Bill a Rapist - turn him for Trump[.] 
should find or more proof of Bill getting kicked out.” 

54. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE: “With family, 25 th 
wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more 
dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging . . .Time to 
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That 
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, 
memory bad, has stroke - neither he nor she well. I expect that much of next dump focus, setting 
stage for Foundation debacle.” Based on my training, experience, and review of materials in this 
case, it appears that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” 
refers to Julian ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London 
Embassy in 2016. As discussed above, Guccifer released information hacked from the DCCC on 
August 12, 2016 (the date CORSI identified as when he would “return home.”). 

55. On or about August 16, 2016, CORSI, emailed STONE a link to a piece CORSI 
had written about STONE titled, “Trump Adviser: WikiLeaks Plotting Email Dump to Derail 
Hillary.” 
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56. On or about August 31,2016, CORSI, using emailed STONE: “Did you get the 
Podesta writeup.” STONE replied “yes.” 

57. On or about September 6, 2016, CORSI, emailed STONE: “Roger[,] Is NY Post 
going to use the Pedesta [sic] stuff?” 

58. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 

59. On or about October 12, 2016, the same day on which Podesta accused STONE of 
having advance knowledge of the publication of his emails, CORSI emailed STONE with the 
subject line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that, 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” CORSI 
followed up several minutes later with another email to STONE titled, “Podesta talking points,” 
with the text “sent a second time just to be sure you go it.” STONE emailed CORSI, “Got them 
and used them.” 

60. On or about October 17, 2016, CORSI emailed STONE with the subject, “Fwd: 
ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’d dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 
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61. On or about November 1, 2016, using the Target Account, emailed 

CORSI and STONE with the subject: “Turkey is a ‘GO’ - FULL GREEN LIGHT.” 

wrote: “My good friend Husyein will be caking [sic] you he is in the Presidents office. The call 
is a go. He has all the information you and DJT need for an article and another October surprise.” 
CORSI emailed back to the Target Account and S'l'ONE: “And 1 have everything in progress 
for a phone call tomorrow with DJT. I’m working with Roger Stone to accomplish this — Roger 
is copied above so he is up to date on status.” 

62. On or about November 2, 2016^^^^^^, using the Target Account, wrote to 
STONE and CORSI: “The message from President Erdogan has been sent to you for DJT has 
just been sent wrapped in an article about baseball as header. If there is a response please let me 
know.” 

63. On or about November 13, 2016, , using the Target Account, 

emailed Stone, wrote, “Well, we did it and now have an opportunity of a lifetime to 

take the country back. God is good and we are well placed to steer things well. You deserve a lot 
of credit and working with you and Jeri Corsi, who is with me now in London has been a great 

joy.” 


64. On or about January 7, 2017, emailed STONE, and 

(using the Target Account) with the subject line, “in case you need his 

mail.” Attached to the message was a scan of a business card for John Podesta. Several 

hours later^^^^^^^, using the Target Account, replied to all recipients, “Ha... maybe he 
wants to go phishing with us?” 

65. I know from my training and experience that the term “phishing” is used to refer 


to the practice of sending emails purporting to be from a reputable party in order to induce 
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individuals to reveal personal information, including passwords. Public reports indicate that 
Podesta’s emails were obtaining through a “phishing” scheme. 


E. 


Use of the Target Account to Communicate with Other Campaign 


Officials 

66. According to documents produced by the Campaign (both voluntarily 

has used the Target Account to correspond with 
individuals throughout the Campaign. For example, on or about October 23, 2015, 
the Target Account, emailed 

stated that “[it] was so good talking to you earlier in the week — it has sustained me all week. 
Thank you for your contribution to this campaign and to our great country. I look forward to 
working with you on a host of things.” 


67. On or about February 28, 2016, using the Target Account, emailed 

with the subject line “Trump on Putin.” The text of the 
message read: “Pass this to Donald,” and contained an article by CORSI about how Putin 
“fear[ed] impact on his plans if Trump takes victory.” 

On or about April 2016,^^^^^^|, 

to introduce an individual who was interested in working with the Trump Campaign. 

69. On or about May 25, 2016, emailed the Target Account about a book 

he was “toying with the idea of writing.” wrote back noting that, “Roger Stone is 

getting me On the list to go to Cleveland [the site of the Republican National Convention].” 

70. On or about August 30, 106 using the Target Account, emailed 

Steve BANNON to report that he had been writing “op-eds” and strategy pieces, “laboring non 
stop for the Trump campaign even though I am all the way over here in Oxford.” 
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wrote that he had been “in constant touch with the campaign, Roger Stone, and Jeri Corsi.” 

suggested a “clever idea for . . . the first debate.” In his idea, then-candidate Trump 
would present then-candidate Clinton with a “Writ of Indictment,” for “undeniable crimes 
against America, destruction of evidence in the form of mails, and theft of funds to your own 
personal benefit and enrichment.” 

71. On or about October 25, 2016, using the Target Account, emailed 

regarding a piece had written about how 



BACKGROUND CONCERNING EMAIL 


72. In my training and experience, I have learned that the Providers provide a variety 
of on-line services, including electronic mail (“email”) and search engines (in the case of Google 
and Yahoo), to the public. The Providers allow subscribers to obtain email accounts at the 
domain names identified in the email addresses contained in Attachment A. Subscribers obtain 
an account by registering with the Providers. During the registration process, the Providers ask 
subscribers to provide basic personal information. Therefore, the computers of the Providers are 
likely to contain stored electronic communications (including retrieved and unretrieved email) 
for their subscribers and information concerning subscribers and their use of services, such as 
account access information, email transaction information, and account application information. 
In my training and experience, such information may constitute evidence of the crimes under 
investigation because the information can be used to identify the account’s user or users. 

73. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
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other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

74. In my training and experience, email providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (/. e ., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the provider’s website), and other log files that reflect usage 
of the account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to access 
the email account. 

75. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and 
the provider’s support services, as well as records of any actions taken by the provider or user as 
a result of the communications. In my training and experience, such information may constitute 
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evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

76. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email provider can show how and when the account was accessed 
or used. For example, as described below, email providers typically log the Internet Protocol 
(IP) addresses from which users access the email account, along with the time and date of that 
access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
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communications relating to the crime), or consciousness of guilt ( e.g deleting communications 
in an effort to conceal them from law enforcement). 

77. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

78. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the account in Attachment A and 
particularly described in Section I of Attachment B. Upon receipt of the information described 
in Section I of Attachments B, government-authorized persons will review that information to 
locate the items described in Section II of Attachment B. The items identified in Attachments A 
will also be screened by reviewers not on the prosecution team to identify and filter out 
privileged material. 

CONCLUSION 

79. STONE instructed CORSI to “Get to Assange” at the Ecuadorian Embassy 

regarding upcoming leaks. STONE then instructed CORSI to have (the user of the 

Target Account) talk to ASSANGE. CORSI subsequently emailed STONE that “word is friend 
in embassy [ASSANGE] plans 2 more dumps. One shortly after I’m back. 2nd in October. 
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w 
enemy if they are not ready to drop HRC.” Two releases, one from Guccifer and the other from 
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WikiLeaks, occurred at the times predicted by CORSI. CORSI later emailed STONE “talking 
points” about Podesta. In January, (using the Target Account), STONE, and 

CORSI received an email from an individual regarding Podesta, and wrote back, 

using the Target Account, “Ha... maybe he wants to go phishing with us? 

80. Based on the forgoing, I request that the Court issue the proposed search warrant. 

81. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 


82. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 


documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted. 





“Amy E. Stnderson 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 



of December, 2017. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


This warrant applies to information associated with the following Google account: 
i. 

that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business 
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT B 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the 
account, including copies of e-mails sent to and from the account, draft e-mails, the 
source and destination e-mails sent addresses associated with each e-mail, the date and 
time at which each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I. A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

a. Any and all records that relate in any way to the account described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 
(fraud and related activities in connection with computers), 52 U.S.C. § 30121 (foreign 
contribution ban), 18 U.S.C. § 371 (conspiracy to commit an offense against the United 
States), and 18 U.S.C. § 2 (aiding and abetting) for the period from January 1, 2015 to the 
present, including: 


a. All records, information, documents or tangible materials that relate in any 
way to communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to Julian 
Assange; 

b. All records, information, documents or tan gible mat erials that relate in any 

way to communications or meetings between Jerome Corsi, Roger 

Stone, and individuals associate with WikiLeaks or Turkey; 

b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 


c. Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 

d. Evidence of the times the account was used; 

e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories 
identified in subsection II. A; and 

i. All “address books” or other lists of contacts. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COI ,[ JMRTA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 


Case: 1:17-mj-00982 
Assigned To : Howell, Beryl A. 

Assign. Date : 12/19/2017 
Description: Search and Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
T O REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. S 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mountain View, California not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States ... that - has jurisdiction over the offense being investigated.” 
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18 1 U.S.C. § 2711 (3)(A)(i). As discussed fully below, acts or omissions in furtherance of the 
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 .. . may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [s/c] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. At the present time, law enforcement officers of the FBI are conducting an 
investigation into violations related to 18 U.S.C. § 1030 (fraud and related activities in connection 
with computers), 52 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to 
commit an offense against the United States), and 18 U.S.C. § 2 (aiding and abetting), arising out 
of the conduct of Roger Stone, and others. The investigation in ongoing, and 

individuals associated with these offenses are not aware of the investigation. If they are made 
aware of the existence and contents of this search warrant, they may seek to delete additional 

information contained in online platforms or otherwise destroy records related to the investigation. 

3 
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REQUEST FOR SEALING AND NON-DISCLOSURE 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither 
public nor known to the targets of the investigation, and its disclosure may alert these targets to 
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would 
be immediately prompted to destroy or conceal incriminating evidence, alter their operational 
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid 
future prosecution. In particular, given that they are known to use electronic communication and 
remote computing services, the potential target could quickly and easily destroy or encrypt digital 
evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is 
Google’s policy and practice, upon receipt of a warrant seeking the contents of electronically 
stored wire or electronic communications for a certain account, to notify the subscriber or customer 
of the existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 

Respectfully submitted, 

ROBERT S. MUELLER, III 
Special Counsel 

Dated: \Z/I1 /h)l9 By: =i 

Aaron SJ. ZeUilsky 

The Special Counsel’s Office 

(202)-5mX)37 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COI ,T IMRTA 


DEC 1 9 2017 

Clerk, U.S. District & Bankruptcy 
Courts for ttis District of Gotesbla . 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 



Case: 1:17-mj-00982 
Assigned To : Howell, Beryl A. 

Assign. Date : 12/19/2017 
Description: Search and Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google, an electronic communication and/or remote computing service s 
headquartered at 1600 Amphitheatre Parkway, Mountain View, California not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 

THE HONOR-ABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 

tz/ff/to fl 

Date 
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AO 93 (Rev 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH VARIOUS APPLE 
ACCOUNTS 


) 

) Case: 1:18-sc-00662 
) Assigned To : Howell, Beryl A. 

Assign. Date : 3/14/2018 
j Description: Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of _Ca lifornia 

(identify the person or describe the property to be searched and give its location): 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before March 28, 2018 _ (not to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to _ Hon. Beryl A. Howell_ _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _. 


Date and time issued: 


~b//Y/ zs/ g 

* Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 


City and state: 


Washington, DC 
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AO 93 (Rev 1 ]/]3) Search and Seizure Warrant (Page 2) 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Apple Accounts: 





that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business 
with offices located at 1 Infinite Loop, Cupertino, California 95014. 
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ATTACHMENT B 
Particular Things to be Seized 
I. Information to be disclosed by Apple 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, including any messages, records, files, logs, or information that 
have been deleted but are still available to Apple, or have been preserved pursuant to a request 
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following information to the 
government, in unencrypted form whenever available, for each account or identifier listed in 
Attachment A: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, methods of connecting, and means and source of payment 
(including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers. Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
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Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 

* 

e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks 
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address 
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books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails, 
device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, mail logs, 
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of 
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS 
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services. Game Center 
logs. Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs 
associated with web-based access of Apple services (including all associated identifiers); 

g. All records and information regarding locations where the account was accessed, 
including all data stored in connection with Location Services; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 

a. Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and 
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January 
2015 to the present, including: 

All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange; 

b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 


c. Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 

d. Evidence of the times the account was used; 

e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories 
identified in subsection II. A; and 

i. All “address books” or other lists of contacts. 
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AO 106 (Rev 04/10) Application for a Search Warrant 


United States District Court 

for the 

District of Columbia 



mar I 4 2018 

y ,S :. Distriut & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH VARIOUS APPLE 
ACCOUNTS 


) 

) 

) 

) 

) 

) 


Case: 1:18-sc-00662 
Assigned To : Howell, Beryl A. 

Assign. Date : 3/14/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that 1 have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A. 

located in the _ Northern District of _California_, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B. 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

(?f evidence of a crime; 

contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §§ 2, 3, 4, 371, 1343 Aiding & Abetting (§2); Accessory after the Fact (§3); Misprison of a Felony (§4); 
and 1349; and Conspiracy (§371); Computer Fraud (§1030); Wire Fraud (§1343); Attempt and 

52 U.S.C. § 30121(a)(1)(C) Conspiracy to Commit Wire Fraud (§1349); and Foreign Expenditure Ban (§30121) 

The application is based on these facts: 


See attached Affidavit. 


(jf Continued on the attached sheet. 

□ Delayed notice of_ days (give exact ending date if more than 30 days: 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: 







Aaron Zelinsky (ASC) 


Applicant's signature 

Curtis Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 
Date: 3/14/2018 _ 



Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Wash ington, D.C. 


Printed name and title 
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filed 


IN THE UNITED STATES DISTRICT COURT MAR 1 4 201 8 

FOR THE DISTRICT OF COLUMBIA 

IN THE MATTER OF THE SEARCH OF Case: 1 : 1 8-sc-00662 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

VARIOUS APPLE ACCOUNTS Assign. Date : 3/14/201 8 

Description: Search & Seizure Warrant 




AFFIDAVIT IN SUPPORT OF 
AN APPLIC ATION FOR A SEARCH WARRANT 


I, Curtis Heide, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for 
information associated with the following Apple Accounts: 



that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business 
with offices located at 1 Infinite Loop, Cupertino, California 95014. The information to be 
disclosed by Apple and searched by the government is described in the following paragraphs and 
in Attachments A and B. This affidavit is made in support of an application for a search warrant. 

2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of 
investigation for 11 years. In the course of my duties, I have been responsible for investigating 
federal crimes and national security matters involving both counterintelligence and issues related 
to cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 
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4. Based on my training and experience and the facts as set forth in this affidavit, 

-there is-probable- eause-to-believe-that-the-T-arget-Accounts-contain communications relevant to— 

violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy),, 18 U.S.C. § 1030 
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 
(attempt and conspiracy to commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution 
ban) (the “Subject Offenses”). 1 

5. As set forth below, Roger STONE communicated directly via Twitter with 

WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used to disseminate hacked 
information. STONE, using his Account, also emailed instructions to Jerome CORSI to 

“Get to Assange” in person at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” 
CORSI emailed STONE back that it was “Time to let more than Podesta to be exposed” (before 
any of Podesta’s emails were leaked). After Podesta’s emails were leaked, CORSI emailed 
STONE “talking points” about Podesta. CORSI also emailed Stone to convey information “from 
a very trusted source” regarding Julian ASSANGE, WikiLeaks, and potential future disclosures. 
BANNON also sent text messages to STONE discussing potential upcoming leaks by 
ASSANGE. The Target Accounts are STONE’s iCloud accounts, which are registered to the 
email accounts STONE used to communicate with CORSI. 

JURISDICTION 


1 Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent 
expenditure in connection with federal elections. 52 U.S.C. § 30121(a)(1)(C); see also id. § 30101(9) & (17) 
(defining the terms “expenditure” and “independent expenditure”). 


2 
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6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
—eompetent-jur-isdietion--as-de-fmed by-1-8 UtStG.-§^ 7-11—/6/r-§§-2-703(a-)r(b)(4-)(-A-) r &-(e-)(-l-)(A-). 

Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711 (3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 7. 

PROBABLE CAUSE 

A. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 

Hacking Activity during the 2016 Presidential Election 

7. On October 7, 2016, the U.S. Department of Homeland Security and Office of the 
Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. 2 In the report, the USIC 
assessed the following: 

8. The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of e-mails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked e-mails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 


2 “Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on 
Election Security,” Oct. 7, 2016, available at ttps://www.dhs.gov/news/2016/10/07/joint-statement-department- 
homeland-security-and-office-director-national. 


3 
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influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” 3 In the report, the USIC 
assessed the following: 

10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed 
at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

11. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

12. With respect to hacking activity, the USIC assessed: “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” In addition, “In July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC further assessed that cyber 

3 “Assessing Russian Activities and Intentions in Recent US Elections,” Jan. 6, 2017, available at 
https://www.dni.gov/files/documents/ICA_2017_01 .pdf. 
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operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU) 
“resulted in the compromise of the personal e-mail accounts of Democratic Party officials and 
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

13. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

1. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his likely Russian identity throughout the 
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted 
with journalists. 

A. Roger Stone’s Disclosed Interactions with Guccifer 2.0 and WikiLeaks. 

2. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

3. As discussed further below, Stone made a number of public references to 
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via 
Twitter with Guccifer 2.0. 

4. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 

21, 2016 release of hacked documents. 


5 
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5. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

6. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

7. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

8. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
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numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

9. On August 13, 2016, Stone posted a tweet using @RogerJ Stone Jr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

10. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

11. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

12. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a ‘“mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 


7 
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13. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

14. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

15. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of WikiLeaks’ 10-year anniversary celebration - Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

16. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

17. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

18. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta - referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
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[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

19. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

B. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 

20. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStone Jr. 

21. On October 13,2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 
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22. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

23. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you Y'correctY' me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 

24. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 
communicate.” 

25. In addition, @RogerJStoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 
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26. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

C. Roger Stone’s Private Email and Text Messages Regarding WikiLeaks, Julian 

Assange, Russia, and John Podesta 

27. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

issued a search warrant for STONE’s address, On October 

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE’s address, 

Information recovered pursuant to those search warrant indicated the 

following: 

28. On July 25, 2016, STONE sent an email from his Account to Jerome 

CORSI, an author and political commentator, with the subject line, “Get to Assange.” The body 
of the message read: “Get to Assange [a]t Ecuadorian Embassy in London and get pending 
WikiLeaks emails...they deal with Foundation, allegedly.” 

29. On or about August 2, 2016 (approximately 19 days before STONE publicly 

tweeted about “Podesta’s time in the barrel”), CORSI emailed the Account, “Word is 

friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to 
be very damaging . . .Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to 
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much 
of next dump focus, setting stage for Foundation debacle.” Based on my training, experience, 
and review of materials in this case, it appears that CORSI’s reference to a “friend in embassy 
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[who] plans 2 more dumps” refers to Julian ASSANGE, the founder of WikiLeaks, who resided 
in Ecuador’s London Embassy in 2016. 

30. On or about August 5, 2016, an associate of STONE’s emailed 

him a link to a poll indicated that Clinton lea Trump by 15 points. STONE responded “enjoy it 
while u can[.] I dined with my new pal Julian Assange last night.” subsequently 

stated to investigators that, around the same time, STONE told him he had gone to London to 
meet ASSANGE. also stated that in 2018, told STONE he would be 

interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE. 
STONE told^^^^^^J he was joking and had not actually met Assange. 

31. On or about August 16, 2016, CORSI emailed STONE a link to a piece CORSI 
had written about STONE titled, “Trump Adviser: WikiLeaks Plotting Email Dump to Derail 
Hillary.” 

32. On August 19, 2016, Bannon sent Stone a text message asking if he could talk 
that morning. On August 20, 2016, Stone replied, “when can u talk???” 

33. On or about August 31, 2016, CORSI emailed STONE: “Did you get the Podesta 
writeup.” STONE replied “yes.” 

34. On September 4, 2016, Stone texted Bannon that he was in New York City for a 
few more days, and asked if Bannon was able to talk. 

35. On or about September 6, 2016, CORSI emailed STONE: “Roger[,] Is NY Post 
going to use the Pedesta [sic] stuff?” 

36. On September 7, 2016, Stone and Bannon texted to arrange a meeting on 
September 8, 2016 at the Warner Center in New York. 
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37. On September 7, 2016, Bannon texted Stone asking him if he could “come by 
trump tower now???” 

38. On September 8, 2016, Stone and Bannon texted about arranging a meeting in 
New York. 

39. On October 3, 2016, an associate of Stone emailed Stone and asked: “Assange - 
what’s he got? Hope it’s good.” Stone wrote back, “It is. I’d tell Bannon but he doesn’t call me 
back. My book on the TRUMP campaign will be out in Jan. Many scores will be settled.” The 
associate forwarded the email to Bannon and wrote: “You should call Roger. See below. You 
didn’t get from me.” Bannon wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

40. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information "affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process." ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next 10 weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

41. Later that day, BANNON emailed STONE, “What was that this morning???” 

STONE replied, “Fear. Serious security concern. He thinks they are going to kill him and the 
London police are standing done [sic]. “ BANNON wrote back, “He didn’t cut deal w/ 
clintons???” Stone replied, “Don't think so BUT his lawyer is a big democrat.” 
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42. When B ANN ON spoke with investigators during a voluntary proffer on February 
14, 2018, he initially denied knowing whether the October 4, 2017 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

43. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 

44. On or about October 12, 2016, the same day on which Podesta accused STONE of 

having advance knowledge of the publication of his emails, CORSI emailed STONE on both the 
email accounts, with a subject line “Podesta talking points.” Attached to the email was a file 
labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The “talking points” 
included the statement that “Podesta is at the heart of a Russian-government money laundering 
operation that benefits financially Podesta personally and the Clintons through the Clinton 
Foundation.” CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you go it.” STONE emailed 
CORSI back via the Account, “Got them and used them.” 

45. On or about October 17, 2016, CORSI emailed the STONE with the subject, 

“Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded 
an email with the header information stripped out, showing only the body text. The email read, 
“Yes[.j I figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on 
them if they move to extradite him. My guess is that he has a set of dead man files that include 
Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out 
to save him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, 
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Assange can kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s 
bluff and raised him the election.” 

46. On or about January 7, 2017, emailed STONE, CORSI, and 


m| with the subject line, “in case you need his mail.” Attached to the 

message was a scan of a business card for John Podesta. Several hours later, replied 

to all recipients: “Ha... maybe he wants to go phishing with us?” 


47. I know from my training and experience that the term “phishing” is used to refer 
to the practice of sending emails purporting to be from a reputable party in order to induce 
individuals to reveal personal information, including passwords. Public reports indicate that 
Podesta’s emails were obtaining through a “phishing” scheme. 

D. STONE’s Recent Public Statements Regarding Contact with Assange 

48. As described above, STONE stated that on October 12,2016 that he was in 
contact with ASSANGE via a “a mutual friend who’s traveled to London several times,” and that 
“everything I know is through that channel of communications.” 

49. On March 13, 2018, the Washington Post published an article about STONE’s 
previous claims of contact with Assange. 4 The cited an anonymous source who claimed to have a 
conversation with STONE in the “spring of 2016” where STONE indicated that he had learned 
from “Julian Assange that his organization had obtained emails that would torment senior 
Democrats such as John Podesta,” and that the conversation occurred before it became publicly 
known that hackers had obtained the “emails of Podesta and of the Democratic National 

4 https://www.washingtonpost.com/politics/roger-stone-claimed-contact-with-wikileaks-founder-julian-assange-in- 
2016-according-to-two-associates/2018/03/13/a263fB42-2604-l le8-b79d-f3d931db7f68_story.html?hpid=hp_rhp- 
top-table-main_stone-656am%3Ahomepage%2Fstory 
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Committee.” The article also cited statements that STONE stated he had spoken to 

ASSANGE. The article cited STONE denying any advance notice about the hacked emails or 
any “contact with Assange.” The Article stated that STONE “said he only recalled having one 
conversation with anyone in which he alluded to meeting the WikiLeaks founder - a comment he 
said he made as a joke to Nunberg.” STONE was quoted as stating, “The allegation I met with 
Assange, or asked for a meeting or communicated with Assange, is provably false.” 

50. The article also stated that STONE told the House Intelligence Committee in 
September 2017 that his August 21 tweet was meant as a prediction that Podesta’s business 
opportunities would come under scrutiny after Paul MANAFORT was forced to resign amid 
allegations about his work for a pro-Russian party in Ukraine. MANAFORT resigned from the 
Campaign on or about August 19, 2016. CORSE s email to STONE about WikiLeaks and “Time 
to let more than Podesta to be exposed as in bed w.cnemy if they are not ready to drop HRC,” 
occurred on August 2, 2016, over two weeks before MANAFORT’s resignation. 

E. STONE’s use of the Target Accounts 

51. On November 21,2017, Chief Judge Beryl A. Howell signed an order pursuant to 
18 U.S.C. §2703(d) for header information related to the Target Accounts. Pursuant to that 
order, Apple provided the following information: 

52. Target Account 1 has the Apple ID an email address 

associated with STONE discussed above. The associated email address is 

The company registered as the account user is Citroen Associates, a 
company linked to STONE by investigators. Additionally, the “rescue email” is 

which is STONE’s account. IP login information shows that the 

account was in use as of the time of the service of the Order According to Apple, the system has 
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been set to a “Full iCloud” backup. I know from my training and experience that a full iCloud 
backup can include other databases and messaging features, including third party messaging 
programs. Often individuals are unaware that the information is being stored in their iCloud, and 
therefore the iCloud may contain additional communications not contained in the standard mail 
accounts. STONE’s email account also contains messages regarding 

his iCloud account, including an indication that iCloud storage was “full.” STONE also used 
Target Account l’s associated iCloud email account, to send an email 

in March, 2017. 

53. Target Account 2 has the Apple ID an email address 

associated with STONE. Target Account 2 is registered to “Roger Stone,” and according to 
information provided by Apple pursuant to the § 2703(d) order, contains a full iCloud backup as 
well. The account is currently locked. 

INFORMATION REGARDING APPLE ID AND iCLOUD 5 

54. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 
the Mac OS operating system. 


The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.applc.com/privacv/docs/lcgal-process-auidclines-us.p dr: “Create and start using an Apple ID,” 
available at https://sunporl.applc.com/en-us/HT203993: “iCloud,” available at htt p://www.applc.com/icloud/ : 
“iCloud: iCloud storage and backup overview,” available at https://supPort.apnle.com/kb/Pl 112519 : and “iOS 
Security,” available at htt p://images.apple.com/nrivacv/docs/iOS Security Gtiide.p df. 
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55. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

c. iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 
to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs enables iCloud to be used 
to synchronize webpages opened in the Safari web browsers on all of the user’s Apple devices. 

iWorks Apps, a suite of productivity apps (Pages, Numbers, and Keynote), enables iCloud to be 
used to create, store, and share documents, spreadsheets, and presentations. iCloud Keychain 
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enables a user to keep website username and passwords, credit card information, and Wi-Fi 
network information synchronized across multiple Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f. Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased .through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 

56. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

57. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
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third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

58. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 

59. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, and “mail logs” for activity over an Apple-provided email 
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account. Records relating to the use of the Find My iPhone service, including connection logs 
and requests to remotely lock or erase a device, are also maintained by Apple. 

60. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 
device. 

61. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWorks and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
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videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, and other data. Records and data associated with third-party apps 
may also be stored on iCloud; for example, the iOS app for WhatsApp, an instant messaging 
service, can be configured to regularly back up a user’s instant messages on iCloud. Some of 
this data is stored on Apple’s servers in an encrypted form but can nonetheless be decrypted by 
Apple. 

62. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. 

63. The stored communications and files connected to an Apple ID may provide 
direct evidence of the offenses under investigation. For example, stored iMessage 
communications, voicemails, and emails may contain conversations with foreign government 
officials similar to those described above in PAPADOPOULOS’s Linkedln and Gmail accounts. 
Based on my training and experience, instant messages, emails, voicemails, photos, videos, and 
documents are often created and used in furtherance of criminal activity, including to 
communicate and facilitate the offenses under investigation. 

64. In addition, the user’s account activity, logs, stored electronic communications, 

and other data retained by Apple can indicate who has used or controlled the account. This “user 
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attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, subscriber information, email and messaging logs, 
documents, and photos and videos (and the data associated with the foregoing, such as geo¬ 
location, date and time) may be evidence of who used or controlled the account at a relevant 
time. As an example, because every device has unique hardware and software identifiers, and 
because every device that connects to the Internet must use an IP address, IP address and device 
identifier information can help to identify which computers or other devices were used to access 
the account. Such information also allows investigators to understand the geographic and 
chronological context of access, use, and events relating to the crime under investigation. 

65. Account activity may also provide relevant insight into the account owner’s state 
of mind as it relates to the offenses under investigation. For example, information on the account 
may indicate the owner’s motive and intent to commit a crime (e.g., information indicating a 
plan to commit a crime), or consciousness of guilt (e.g., deleting account information in an effort 
to conceal evidence from law enforcement). 

66. Other information connected to an Apple ID may lead to the discovery of 
additional evidence. For example, the identification of apps downloaded from App Store and 
iTunes Store may reveal services used in furtherance of the crimes under investigation or 
services used to communicate with co-conspirators. For instance, if there are secured and 
encrypted communication applications downloaded from the App Store, that can show an 
attempt to hide information from investigators. In addition, emails, instant messages, Internet 
activity, documents, and contact and calendar information can lead to the identification of co¬ 
conspirators and instrumentalities of the crimes under investigation. 
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67. Therefore, Apple’s servers are likely to contain stored electronic communications 
and information concerning subscribers and their use of Apple’s services. In my training and 
experience, such information may constitute evidence of the crimes under investigation including 
information that can be used to identify the account’s user or users. 

CONCLUSION 

68. STONE instructed CORSI to “Get to Assange” at the Ecuadorian Embassy 

regarding upcoming leaks, and CORSI emailed Stone on the Account that it was “Time 

to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” 
STONE also texted and emailed BANNON about potential forthcoming leaks from ASSANGE 
and WikiLeaks. There is therefore probable cause to believe that evidence of the DNC hack and 
the hacking of other emails associated with the 2016 election will be found in the information 
associated with the Target Accounts. 

69. Based on the forgoing, I request that the Court issue the proposed search warrant. 

70. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


71. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Federal Bureau of Investigation 


Subscribed and sworn to before me on 


this /^ {jay 


of March, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Apple Accounts: 





that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business 
with offices located at 1 Infinite Loop, Cupertino, California 95014. 
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ATTACHMENT B 
Particular Things to be Seized 
I. Information to be disclosed by Apple 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, including any messages, records, files, logs, or information that 
have been deleted but are still available to Apple, or have been preserved pursuant to a request 
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following information to the 
government, in unencrypted form whenever available, for each account or identifier listed in 
Attachment A: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, methods of connecting, and means and source of payment 
(including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers. Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
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Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 

* 

e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks 
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address 
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books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails, 
device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, mail logs, 
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of 
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS 
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services. Game Center 
logs. Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs 
associated with web-based access of Apple services (including all associated identifiers); 

g. All records and information regarding locations where the account was accessed, 
including all data stored in connection with Location Services; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 

a. Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and 
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January 
2015 to the present, including: 

All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange; 

b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 


c. Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 

d. Evidence of the times the account was used; 

e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories 
identified in subsection II. A; and 

i. All “address books” or other lists of contacts. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

) Case: 1:18-sc-01518 
) Assigned To : Howell, Beryl A. 
j Assign. Date : 5/4/2018 
J Description: Search & Seizure Warrant 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the Northern District of ______ California 

(identify the person or describe the property to be searched and give its location)'. 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THE GOOGLE 

ACCOUNTr 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)’. 

See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before _ May 18, 2018 __ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howell _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _. 

Date and time issued: ?■ '/r/A _ 

Judge's signature 

City and state: Washington, DC _ Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



£ferk, U.8, District & Bankruptcy 
Cour ts for firs District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THE GOOGLE ACCOUNT 



Case: 1:18-sc-01518 
Assigned To : Howell, Beryl A. 

Assign. Date : 5/4/2018 
Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google LLC, an electronic communication and/or remote computing services with 
headquarters in Mountain View, California, not to disclose the existence or contents of the Warrant 
pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 
and 


Page 1 of2 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year unless 
otherwise ordered by the Court. 



Date 


THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 


Page 2 of 2 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 


|p i 


*m*ED 


for the 

District of Columbia 


MAI » 4 20® 


Clerk, U.s. 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THE GOOG LE 

accountBHMHHHHHHMI 


case: 1:l8-sc-01^"‘ ferUSSSa 

Assigned To : Howell, Beryl A 
Assign. Date : 5/4/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A. 

located in the _ Northern _ District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

&f evidence of a crime; 

fif contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section 

18 U.S.C. §2 
• et al. 


Offense Description 
aiding and abetting 
see attached affidavit 


The application is based on these facts: 

See attached Affidavit. 

$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: 



[Aaron Zelinsky (Special Counsel's Office) 


Applicant’s signature 

Andrew Mitchell, Supervisory Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 
Date: ?///%>/& 

City and state: Washington, D.C. _ 



Judge *s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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I A 



UNITED STATES DISTRICT COURT 2018 

FOR THE DISTRICT OF COLUMBIA clwk| lu . Dist dct & Bankruptcy 

Courts for ths District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THE GOOGLE ACCOUNT 



Case: 1:18-sc-01518 
Assigned To : Howell, Beryl A 
Assign. Date : 5/4/2018 
Description: Search & Seizure 


Warrant 


AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 

I, Andrew Mitchell, having been first duly sworn, hereby depose and state as follows: 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the following Google Account: (hereafter 

the “Target Account 1”), that is stored at premises owned, maintained, controlled or operated by 
Google, Inc., a social networking company headquartered in Mountain View, California 
(“Google”). The information to be searched is described in the following paragraphs and in 
Attachments A and B. This affidavit is made in support of an application for a search warrant 
under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Google to disclose to 
the government copies of the information (including the content of communications) further 
described in Attachment A. Upon receipt of the information described in Attachment A, 
government-authorized persons will review that information to locate the items described in 
Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. As a Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 




Case l:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 7 of 35 


to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a 
false statement); 18 U.S.C. §1651 (perjury); 18 U.S.C. § 1030 (unauthorized access of a 
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to 
commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
Offenses”). 1 

5. As set forth below, in May 2016, Jerome CORSI provided contact information for 

Roger STONE. In July 2016, ^^^^^^tlso STONE that he 
needed to meet with then-candidate Trump “alone.” In August 2016, ^^^^^Jtold STONE 
that there was an “OCTOBER SURPRISE COMING” and that Trump, “[i]s going to be defeated 
unless we intervene. We have critical intel.” In that same time period, STONE communicated 
directly via Twitter with WikiLeaks, Julian ASSANGE, and Guccifer 2.0. On July 25, 2016, 
STONE emailed instructions to Jerome CORSI to “Get to Assange” in person at the Ecuadorian 
Embassy and “get pending WikiLeaks emails[.]” On August 2, 2016, CORSI emailed STONE 
back that,“Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in 
Oct. Impact planned to be very damaging.” On August 20, 2016, CORSI told STONE that they 
needed to meet witb^^^^^^^Ho determine “what if anything Israel plans to do in Oct.” 


1 Federal law prohibits a foreign national from making, directly or indirectly, ail expenditure or independent 
expenditure in connection with federal elections. 52 U.S.C. § 30121(a)(1)(C); see also id. § 30101(9) & (17) 
(defining the terms “expenditure” and “independent expenditure”). 
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Target Account) Account, which 

to communicate with STONE and CORSI. 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 8. 

PROBABLE CAUSE 

A. U.S. Intelligence Community (USIC) Assessment of Russian Government- 
Backed Hacking Activity during the 2016 Presidential Election 

7. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following, with emphasis added: 

8. The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of e mails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked e mails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
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influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

9. On January 6, 2017, the US1C released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aitned 
at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

11. The USIC also described, at a high level, some of the techniques that the Russian 
government employed during its interference. The USIC summarized the efforts as a “Russian 
messaging strategy that blends covert intelligence operations—such as cyber activity—with 
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, 
and paid social media users or ‘trolls.’” 

12. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities to 
the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted in 
the compromise of the personal e-mail accounts of Democratic Party officials and political 
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Figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” The GRU is the 
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia’s largest 
foreign intelligence agency. 

13. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 

• release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

14. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

B. Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks. 

15. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. On August 
7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account 
@RogerJStoneJr. 

16. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 
21, 2016 release of hacked documents. 

17. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 
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18. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

19. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

20. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 
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21. On August 13,2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

22. On August 17,2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

23. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

24. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

25. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 
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26. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

27. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of WikiLeaks’ 10-year anniversary celebration - Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

28. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

29. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #Hil!aryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

30. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “1 have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
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him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

31. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email-(speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

C. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian 
Assange. 

32. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

33. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 
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34. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you Y'correctY me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 

35. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 
communicate.” 

36. In addition, @RogerJStoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

37. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 
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61. On or about July 8, 2016, STONE wrote back, “T not in NYC again before the 
convention. I have pneumonia and may be hospitalized later today. I can get this back on track 
post convention when I can attend. Sorry about the fiasco last week, however you can’t just bring 
the General without tell me - R.” 

62. On or about July 25, 2016, STONE sent an email from his ^^^^^\ccount to 
Jerome CORSi with the subject line, “Get to Assange.” The body of the message read: “Get to 
Assange [a]t Ecuadorian Embassy in London and get pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” 

63. On or about July 29, 2016, ^^^^^^^|sent a messaged to STONE, “HI 
ROGER, I HOPE YOU ARE WELL. HAVE YOU SET UP ANEW MEETING WITH 
TRUMP? I PLAN TO BE BACK IN THE US NEXT WEEK. PLEASE ADVISE. THANK 
YOU. j 

64. On or about July 31, 2016, STONE emailed CORSI with the subject line, “Call 

me MON.” The body of the email read: should see Assangef.] ^^^^^should find 

Bernie [Sjanders brother who called Bill a Rapist - turn him for Trump[.] should find 

||^^m^^|or more proof of Bill getting kicked out.” 

65. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed the STONE, “Word is friend in 
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very 
damaging .. .Time to let more than Podesta to be exposed as in bed w enemy if they are not 

ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start 

! 

suggesting HRC old, memory bad, has stroke — neither he nor she well. I expect that much of 
next dump focus, setting stage for Foundation debacle.” Investigators believe that CORSI’s 
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72. On or about 'November 7, 201STONE, 

“ROGER,JERRY- SORRY, BUT DUE TO AN UNEXPECTED EMERGENCY I HAVE TO 
CANCEL TODAY’S MEETING AT 9. THANKS . HAVING a TIA. Early Stroke.” 
STONE responded, “Take care of yourself.” ^^^^^^^Avrote back, “Tnaks Xou RGer. Blury 
Virson.” STONE replied, “You can’t die until after we elect Donald.” 

F. Stone’s HPSCI Testimony and Subsequent Conversations 

73. According to publicly-available reporting, Stone testified before the House 
Permanent Select Intelligence Committee (HPSCI) on September 26, 2017. STONE released his 
prepared remarks to the media. In his remarks, Stone stated that he had learned Assange was in 
possession of the DNC emails via Twitter, and that he asked a “journalist” to “independently 
confirm this report.” Stone stated his “intermediary” had “assured me that WikiLeaks would 
release this information in October and continued to assure me of this throughout the balance of 
August and all of September.” Stone denied knowledge in advance of Podesta’s emails being 
hacked. Accordingly to publicly-available news reports, Stone subsequently informed HPSCI 
that his intermediary was Randy Credico, an American radio host. 

74. On or about November 24, 2017, Credico texted Stone, “I told you to watch his 
Tweets in October not before that 1 knew nothing about the DNC stuff. I just followed his 
Tweets.” Stone responded, “U never said anything about the DNC but it was August.” Credico 
replied, “It was not August because I didn’t interview him or meet him until August 26 th .” 

75. Credico and Stone continued to exchange messages, and on December 1, 2017, 
Credico wrote: “I don’t know why you had to lie and say you had a back Channel now I had to 
give all of my forensic evidence to the FBI today what a headache. You could have just told him 
the truth that you didn’t have a back channel they now know that I was not in London until 
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September of this year. You had no back-channel and you could have just told the truth. You 
want me to cover you for perjury now.” 6 Stone responded, “What the fuck is your problem? 
Neither of us has done anything wrong or illegal. You got the best press of your life and you can 
get away with asserting for 5th amendment rights if u don’t want talk about[.] And if you turned 
over anything to the FBI you’re a fool.” Credico replied, “You open yourself up to six counts of 
perjury. But Pm sure that wasn’t sworn testimony so you’re probably clear. ..You should go 
back in a minute your testimony and tell them the truth ... You need to amend your testimony 
before I testify on the 15 th .” Stone wrote, “If you testify you’re a fool. Because of tromp [sic] I 
could never get away with a certain [sic] my Fifth Amendment rights but you can. I guarantee 
you you are the one who gets indicted for perjury if you’re stupid enough to testify.” Stone and 
Credico continued to correspond, and according to publicly available news reports, on December 
13, 2017, Credico asserted his Fifth Amendment right not to testify before the HPSCI. 

76. On January 25, 2018, Credico texted Stone, “You lied to the house Intel 
committee. But you’ll get off because you’re friends with Trump so don’t worry. I have all the 
forensic evidence. I was not a ba[ck] Channel and I have all those emails from September of 
2016 to prove it.” 

INFORMATION REGARDING GOOGLE 

77. Google provides numerous free services to the users with a Google profile. Some 
of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+ 
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging 
service that provides both text and voice communication. Google Talk conversation logs are 
saved to a “Chats” area in the user’s Gmail account. Google+ is a social networking service. 
Google Drive is a file storage and synchronization service which provides users with cloud 
6 Contrary to his statement, Credico had not provided any information to the FBI. 
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storage, file sharing, and collaborative editing. Google+ Photos (formerly knowns as Picasa Web 
Albums) is an image hosting and sharing web service that allows users with a Google account to 
store and share images for free. YouTube is a free video sharing website that allows users 
upload, view and share videos. Google also retains a record of searches conducted by the user, as 
well as location data for the use of some of the services described above. All of these services 
may record information uploaded, inputted, or gathered from the user. 

CONCLUSION 

78. Based on the forgoing, I request that the Court issue the proposed search warrant. 
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REQUEST FOR SEALING 

79. I further request that the Court order that all papers in support of this application, 
including the application, affidavit and search warrant, be sealed until further order of the Court. 
These documents discuss an ongoing criminal investigation that is neither public nor known to 
all of the targets of the investigation. Accordingly, there is good cause to seal these documents 
because their premature disclosure may give targets an opportunity to flee/continue flight from 
prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates, 
or otherwise seriously jeopardize the investigation. 

RespectfuUyrtiubm itted, 



Andrew T. Mitchell 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this y of May, 2018 





The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to Be Searched 

This warrant applies to information associated with the Google account 

hat is stored at premises owned, maintained, controlled, or operated 
by Google, Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View, 



CA 94043. 
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ATTACHMENT B 

ATTACHMENT B 
Particular Things to be Seized 

I* Files and Accounts to be produced by Google, Inc. between January 1, 2016 and 

the Present. 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f). Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and destination 
e-mails sent addresses associated with each e-mail, the date and time at which each e-mail was 
sent, and the size and length of each e-mail; 1 

b. All existing printouts from original storage of all of the electronic mail described 
above in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in 
Section LA, including log files, dates, times, methods of connecting, ports, dial ups, and/or 
locations; 


e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, telephone 
numbers and other identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the IP address used to 
register the account, log-in IP addresses associated with session times and dates, account status, 
alternative e-mail addresses provided during registration, all screen names associated with 
subscribers and/or accounts, all account names associated with the subscriber, methods of 
connecting, log files, means and source of payment (including any credit or bank account 
number), and detailed billing records; 

g. All records indicating the services available to subscribers of the electronic mail 
address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of circle and 


1 This Search warrant applies on to email sent, received, or drafted on or after May 26, 2017. 
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members, contents of posts, comments, and photos, to include date and timestamp; 

i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private messages, and 
comments; 

k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the account. 
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II. Information to be Seized by Law Enforcement Personnel 

a. Any and all records that relate in any way to the account described in Attachment 
A which is evidence, fruits, and instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a false statement); 18 U.S.C. §1651 
(perjury); 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),, and 52 U.S.C. 

§ 30121 (foreign contribution ban) from Jan 1, 2015 to the present, including: 

All records, information, documents or tangible materials that relate in any way to 
communications with foreign government officials or agents of a foreign power, 
or discussions with others regarding those actions, or plans or attempts at 
undertaking such actions: 

b. All images, messages, communications, calendar entries, search terms, and 
contacts, including any and all preparatory steps taken in furtherance of these crimes; 

c. Communication, information, documentation and records relating to who created, 
used, or communicated with the account or identifier, including records about their identities and 
whereabouts; 

d. Evidence of the times the account was used; 

e. Ail images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 

i. All “address books” or other lists of contacts. 
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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



Case: 1:18~sc-01518 
Assigned To : Howell, Beryl A 
Assign. Date: 5/4/2018 
Description: Search & Seizure 


Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS 


AND TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. 8 2705(B) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to non-disclosure, 
the proposed Order would direct Google LLC, an electronic communication and/or remote 
computing services provider with headquarters in Mountain View, California, not to notify any 
other person (except attorneys for Google for the purpose of receiving legal advice) of the 
existence or content of the Warrant for a period of one year unless otherwise ordered of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. §2711. Specifically, the Court is a 
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“district court of the United States ... that - has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the offense 
under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. 



U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 

U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 

Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 

compelled to supply communications and other records using a subpoena, court order, or search 

warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 

“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 

“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 

Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part. Section 2705(b) provides as follows:. 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 . . . may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 
18 U.S.C. § 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any 
legal process under that provision. 
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deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in — 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying 
a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Warrant for a period of one year unless otherwise 
ordered by the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. At the present time, law enforcement officers of the FBI are conducting an 
investigation into violations related to 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory 
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after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. 
§ 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. 
§ 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) arising out of the conduct of various unknown persons that operated and 
controlled the subject accounts. It does not appear that these individuals are currently aware of the 
nature and scope of the ongoing FBI investigation. 

REQUEST FOR SEALING AND NON-DISCLOSURE 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year unless otherwise ordered by the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither 
public nor known to the targets of the investigation, and its disclosure may alert these targets to 
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would 
be immediately prompted to destroy or conceal incriminating evidence, alter their operational 
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid 
future prosecution. In particular, given that they are known to use electronic communication and 
remote computing services, the potential target could quickly and easily destroy or encrypt digital 
evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should circumstances 
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change such that court-ordered nondisclosure under Section 2705(b) becomes no longer needed, 
the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the Warrant 
will seriously jeopardize the investigation, including by giving the targets an opportunity to flee 
from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)—(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is 
Google’s policy and practice, upon receipt of a warrant seeking the contents of electronically 
stored wire or electronic communications for a certain account, to notify the subscriber or customer 
of the existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
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(except attorneys for Google for the purpose of receiving legal advice) for a period of one year 
unless otherwise ordered by the Court. 


Dated: 


! /’ J) 

<• -* / "V / i Tji 


Respectfully submitted, 

ROBERT S. MUELLER, III 
Special Counsel / 


By: 




Kyle Freeny 
Special Counsel’s 
Office (202) 616-0800 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 

District of Massachusetts 

) Case No. 

) 

) 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ District of_ Massachusetts _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B. 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

The Person of 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

[?f evidence of a crime; 

[?f contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section Offense Description 

18 U.S.C. §§ 2, 3, 4, 371, Aiding & Abetting (§ 2); Accessory after the Fact (§ 3); Misprison of a Felony (§ 4); 

1030, 1343 and 1349 Conspiracy (§ 371); Computer Fraud (§ 1030); Wire Fraud (§ 1343); Attempt and 

Conspiracy to Commit Wire Fraud (§ 1349). 

The application is based on these facts: 

See attached Affidavit. 


sf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Sworn to before me and signed in my presence. 

Date: 03/27/2018 

City and state: Boston, Massachusetts _ 





Applicant s signature 


Curtis Heide, Special Agent, FBI 


Printed name and title 


(m. (!M\ 


_ ' Sftglf 
' ('i 

United States Magistrate Judge Marianne B. Bowler 


Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 

District of Massachusetts 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

The Baggage 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ District of_ Massachusetts _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B. 


Case No. - My __ ^ ^ 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

^ evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section Offense Description 

18 U.S.C. §§ 2, 3, 4, 371, Aiding & Abetting (§ 2); Accessory after the Fact (§ 3); Misprison of a Felony (§ 4); 

1030, 1343 and 1349 Conspiracy (§ 371); Computer Fraud (§ 1030); Wire Fraud (§ 1343); Attempt and 

Conspiracy to Commit Wire Fraud (§ 1349). 

The application is based on these facts: 

See attached Affidavit. 


fif Continued on the attached sheet. 



Curtis Heide, 


Judge 's signat/rff 


□ Delayed notice of 


days (give exact ending date if more than 30 days: 


) is requested 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Sworn to before me and signed in my presence. 

Date: 03/27/2018 

City and state: Boston, Massachusetts _ 


Applicant’s signature 

, Jpecial Agent, FBI 


Printed name and title 


] 


United States Magistrate Judge Marianne B. Bowler 


_ S title 
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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF MASSACHUSETTS 


IN THE MATTER OF THE SEARCH OF 
THE PERSON OF 


IN THE MATTER OF THE SEARCH OF 
THE BAGGAGE OF I 


Case No. / 

Filed Under Seal 

Case No. / V-* 3 -- 
Filed Under Seal 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR SEARCH WARRANTS 

I, Curtis Heide, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for search and seizure warrants 
under Rule 41 of the Federal Rules of Criminal Procedure authorizing the search of the person of 

Target (described further 

Attachment A), and any baggage associated with him (described further in that warrant’s 
Attachment A), and the seizure of the electronic devices and media described in Attac hm ent. B 
(the Target Devices). I anticipate this search will be executed after^^^^^^Jlands at Logan 
International Airport at approximately This warrant is for the 

seizure of the devices only; the Government will seek a warrant to search any seized devices at a 
later point in time. 

2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of 


investigation for 11 years. In the course of my duties, I have been responsible for investigating 
federal crimes and national security matters involving both counterintelligence and issues related 
to cybersecurity. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that ROGER STONE, JEROME CORSI and others have 
committed violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the 
fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. 

§ 1349 (attempt and conspiracy to commit wire fraud) (the “Subject Offenses”). 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because, as described 
further below, it is anticipated that^^^^^^J and his baggage will be located in the District of 
Massachusetts on 

SUMMARY 

6. As set forth below,(the Target Person) was in contact with Roger 
STONE and Jerome CORSI during the summer and fall of 2016, when STONE appears to have 
obtained advance knowledge of the release by WikiLeaks of illegally hacked emails for the 
benefit of the presidential campaign of Donald J. Trump (the “Campaign”). In July 2016, 
STONE instructed CORSI to have^^^^^^^talk with Julian ASSANGE, the founder of 
WikiLeaks, and^^^^^^^served as CORSI’s conduit to ASSANGE to discuss hacked 
information. 


2 
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7. More specifically, on or about July 25, 2016, STONE emailed CORSI to “Get to 
Assange” in person at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” On or 
about July 31, 2016, STONE instructed CORSI to have^^^^|“see ASSANGE.” At the 
time,^^^^^^ lived in London, where Assange was located at the Ecuadorian Embassy. On 
or about August 2, 2016, CORSI told STONE that the “word is friend in embassy [ASSANGE] 
plans 2 more dumps. One shortly after I’m back. 2nd in October. Impact planned to be very 
damaging.... Time to let Podesta to be exposed as in bed w enemy if they are not ready to drop 
HRC.” Information disclosures subsequently occurred on or about the times CORSI predicted. 

8. On or about August 10, 2016,^^^^^^| began emailing CORSI multiple news 
articles regarding ASSANGE and alleged Russian involvement in the election. On or about 
November 13, 2016,emailed STONE to congratulate him on “tak[ing] the country 
back,” and stating, “You deserve a lot of credit and working with you and Jeri Corsi, who is with 
me now in London has been a great joy.” On or about January 7, 201emailed 
STONE and CORSI to joke about John Podesta going “phishing.” As stated below, I know from 
my training and experience that the term “phishing” is used to refer to the practice of sending 
emails purporting to be from a reputable party in order to trick individuals to reveal to the sender 
personal information, including passwords. 

PROBABLE CAUSE TO BELIEVE THAT A FEDERAL CRIME WAS COMMITTED 
A. Background on Relevant Individuals 

i. Roger STONE 

9. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the Campaign until August 
2015. Although STONE had no official relationship with the Campaign thereafter, STONE 
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maintained his support for Trump and continued to make media appearances in support of the 
Campaign. As described further below, STONE also maintained contact with individuals 
employed by the Campaign, including then-campaign chairman Paul MANAFORT and deputy 
chairman Rick GATES. 

ii. Jerome CORSI 

10. Jerome CORSI is a political commentator who, according to publicly-available 
information, serves as the “Washington Bureau Chief for Infowars.com.” According to publicly- 
available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” for the 
website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of books 
regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 
Hacking Activity during the 2016 Presidential Election 


12. On October 7, 2016, the U.S. Department of Homeland Security and Office of the 
Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. 1 In the report, the USIC 
assessed the following: 

13. “The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of e-mails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked e-mails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities.” 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 


1 “Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on 
Election Security,” Oct. 7, 2016, available at ttps://www.dhs. gov/news/2016/10/07/joint-statement-department- 
homeland-security-and-office-director-national. 
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“Assessing Russian Activities and Intentions in Recent US Elections.” 2 In the report, the USIC 
assessed the following: 

15. “[] Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

16. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

17. With respect to hacking activity, the USIC assessed: “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” In addition, “In July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC further assessed that cyber 
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU) 
“resulted in the compromise of the personal e-mail accounts of Democratic Party officials and 
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 


2 “Assessing Russian Activities and Intentions in Recent US Elections,” Jan. 6, 2017, available at 
https://www.dni.gov/files/docurnents/ICA_2017_01 .pdf. 
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18. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

19. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his likely Russian identity throughout the 
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted 
with journalists. 

C. Roger STONE’s Disclosed Interactions with Guccifer 2.0 and WikiLeaks. 

20. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. STONE worked on the Campaign until he was 
fired in August 2015. Although STONE had no official relationship with the Campaign 
thereafter, STONE maintained his support for Trump and continued to make media appearances 
in support of Trump’s presidential campaign. 

21. As discussed further below, STONE made a number of public references to 
WikiLeaks and its release of DNC-related emails. STONE has also stated that he was in contact 
via Twitter with Guccifer 2.0. 

22. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June 
21, 2016 release of hacked documents. 

23. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 
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24. On August 5, 2016, Roger STONE published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” STONE wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” STONE embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” STONE also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

25. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With regard to 
the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be a number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with Assange, he had a close 
friend who served as an intermediary. 

26. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJSTONEJr thanks 
that u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal 
cellphone numbers and email addresses from the files of the Democratic Congressional 
Campaign Committee (DCCC). 
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27. On August 13, 2016, STONE posted a tweet using @RogerJSTONEJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

28. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJSTONEJr paying 
you back.” Guccifer also sent a private message to @RogerJSTONEJr stating “i’m pleased to say 
u r great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

29. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had been working with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

30. On August 21, 2016, using @RogerJSTONEJR, STONE directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

31. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly 
soon. And that of course will answer the question of exactly what was erased on that email 
server.” 
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32. On Saturday, October 1, 2016, using @RogerJSTONEJr, STONE Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

33. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of WikiLeaks’ 10-year anniversary celebration - STONE told Info wars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, STONE 
used @RogerJSTONEJr to tweet: “Payload coming. #Lockthemup.” 

34. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

35. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a l in k 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

36. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta - referring back to STONE’s August 21, 2016 
C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [STONE] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the Miami Herald, STONE responded: “I have never met or spoken 
with Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
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him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

37. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. Roger STONE’s Private Twitter Direct Messages with WikiLeaks and Julian 

Assange. 

38. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJSTONEJr. 

39. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJSTONEJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 
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40. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

41. On October 16, 2016, @RogerJSTONEJr sent a direct message to @wikileaks: 
“Ha! The more you Y'correctV me the more people think you're lying. Your operation leaks like 
a sieve. You need to figure out who your friends are.” 

42. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJSTONEJr containing a single word: “Happy?” @wikileaks 
immediately followed up with another message less than a minute later: “We are now more free 
to communicate.” 

43. In addition, @RogerJSTONEJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJSTONEJr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 
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44. On Saturday, June 10, 2017, @RogerJSTONEJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

E. Roger STONE’s Emails with Jerome CORSI and about Assange 

and WikiLeaks 

45. On or about September 11, 2017, Chief Judge Beryl A. Howell of the District of 

Columbia issued a search warrant for STONE ’ address On 

or about October 17, 2017 Chief Judge Howell issued a warrant for STONE’s^^^Jaddress, 

„ T ' T ' pwwi'i O n or about December 12, 2017, Chief Judge Howell issued a warrant 
fbr^^^^^^^^Gmail address,^^^^^^^^^^^^^^ Emails to that 

search warrant indicated the following: 

46. On or about May 23, 2016,^^^^^^|emailed STONE with the subject, 

“Trump Campaign,” to offer his assistance to the Campaign.^^^^^^|wrote that he was “on 
to the notorious Oxford case already!” He also stated that he was “available, literally, as needed, 
to contribute in ways the campaign sees fit. I’d like to go to Cleveland and pitch in, raise money 
and work for you. Can you use me?” Cleveland, Ohio was the location of the 2016 Republican 
National Convention, held July 18-21, 2016. 

47. On or about June 4, 2016, STONE emailed^^^^^^^elling him to “Plan on 
going to Cleveland. Will need your help. Can handle credentials.” 

48. On or about June 20, 2016,^^^^^^|emailed STONE and MANFORT, asking 

to “know immediately how I can help” the Campaign. also wrote that his “research 

on Rhodes House” was nearing completion. Rhodes House is the headquarters of the Rhodes 
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Trust, which provides scholarships to Oxford University, and the “Rhodes House” research 
appears to be a reference to STONE’s previous tweet on or about October 13, 2015 that, “In 
1969, Bill Clinton was expelled from Oxford for raping nineteen-year-old 
STONE mentioned Wellstone again to|^|^^J a month later, as discussed below. The 
“Rhodes House” research seems to be the same as the “notorious Oxford case” referenced by 
above. 

49. On or about July 7, 2016,emailed STONE that he had “my tickets to 
Cleveland[.] [D]o you have my credential pack?” 

50. On or about July 25, 2016, (approximately three days after WikiLeaks began 

releasing emails hacked from the a commentator who had publicly accused 

the Clinton Foundation of fraud, emailed STONE with the subject line, “You need to get to 
Assange.” The body of the message read: “At Ecuadorian Embassy in London and get the 
pending wikileaks emails...they deal with Foundation, allegedly.” 

approximately 

minutes later STONE called CORSI and they spoke for 26 minutes. 

52. Less than two hours after the phone call to CORSI, STONE emailed CORSI with 
the subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t 
Ecuadorian Embassy in London and get pending WikiLeaks emails.. .they deal with Foundation, 
allegedly.” It appears that STONE cut and pasted the email from Ortel to CORSI. 

53. On or about, July 27, 2016, then-candidate Donald Trump stated in a press 
conference, “Russia, if you are listening, I hope you’re able to find the 30,000 [Hillary Clinton] 
emails that are missing. I think you will probably be rewarded mightily by our press. Let’s see if 
that happens. That will be next.” 
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54. On or about July 28, 2016, Roger STONE called Richard GATES (then the 
deputy-chair of the Campaign). They spoke for approximately twelve minutes. 

55. On or about July 30, 2016, Paul MANAFORT (then the Chairman of the 
Campaign) called STONE. They spoke for approximately one hour and seven minutes. The 
Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven 
minutes is the longest call (by almost a half-hour) that took place between STONE and 
MANAFORT in this time period. 

56. On or about July 31, 2016, STONE emailed CORSI with the subject line, “Call 

me MON.” The body of the email read: should see Assange[.] should find 

Bemie sanders brother who called Bill a Rapist — turn him for Trump[.] should find 

or more proof of Bill getting kicked out.” 

57. On or about August 2, 2016, CORSI emailed STONE: “With family, 25 th 
wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more 
dumps. One shortly after I’m back. 2nd in Oct. Impact planned to be very damaging . . .Time to 
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That 
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, 
memory bad, has stroke — neither he nor she well. I expect that much of next dump focus, setting 
stage for Foundation debacle.” Based on my training, experience, and review of materials in this 
case, it appears that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” 
refers to ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London Embassy in 
2016. On or about August 12, 2016, Guccifer publicly released information hacked from the 
DCCC (the date CORSI identified as when he would “return home.”). 
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58. On or about August 10, 2016,^^^^^^Jemailed CORSI an article titled, 
“Assange Warns of Triangle of Terror’- Clinton, Pentagon & Google.” 

59. On or about August 13, 2016, emailed CORSI a news article titled, 

“Assange Implies Murdered DNC Staffer Was WikiLeaks’ Source.” 

60. On or about August 16, 2016, ^^^^^^^emailed CORSI an email with the 

subject line, “Vladimir Putin Has Already Won Our Election.” The body of email 

contained two words: the word “VENONA” and the word “Observer.” According to publicly 
available information, the “Venona Project” was a top-secret U.S. intelligence effort to gather 
and decrypt messages sent in the 1940s by Soviet military intelligence. On or about August 13, 
2016, the Observer had published an article titled, “Vladimir Putin Has Already Won Our 
Election” (the subject of the email). The subtitle of the article stated: “It’s time to face facts: 
Kre mlin spies and hackers are undermining American politics.” The article further discussed 
how, “WikiLeaks, nowadays a transparent Kremlin front, disseminated some 20,000 purloined 
DNC emails that were stolen by Russian intelligence.” The article also stated that the “Kremlin is 
weaponizing stolen information for political effect.” 

61. On or about August 30, 2016,emailed Steve Bannon, who had 
become chief executive of the Campaign when MANAFORT left the Campaign on or about 
August 19, 2016, with STONE and CORSI cc’d. ^^^^Jj^^wrote offering his assistance and 
stating he had been “labouring non stop for the Trump campaign — even tho[u]gh I am all the 
way over here in Oxford. ... I have been in constant touch with the campaign, Roger Stone and 
Jeri Corsi.” 

62. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 
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63. On or about November 13, 2016,emailed STONE. 

wrote, “Well, we did it and now have an opportunity of a lifetime to take the country back. God 
is good and we are well placed to steer things well. You deserve a lot of credit and working with 
you and Jeri Corsi, who is with me now in London has been a great joy.” 

64. On or about January 7, 2017, an individual named emailed 

STONE, CORSI, and^^^^^^| with the subject line, “in case you need his mail. 

Attached to the message was a scan of a business card for John Podesta. Several hours later, 
^^^^Hreplied: “Ha... maybe he wants to go phishing with us?” 

65. I know from my training and experience that the term “phishing” is used to refer 
to the practice of sending emails purporting to be from a reputable party in order to trick 
individuals to reveal to the sender personal information, including passwords. Public reports 
indicate that Podesta’s emails were obtaining through a “phishing” scheme. 



of reaching him. A publicly-available database lists the U.K. email address as belonging to 
The U.K. email address is housed outside the United States, and investigators 
anticipate it may take substantial time to retrieve the messages on the account via a potential 
treaty request. In addition, it is possible that emails may have been deleted or no longer 
maintained. I know from my training and experienced that users often download and store emails 
on their phones, tablets, and laptops, such as the Target Devices. Even if information has been 
deleted by the user, the Government may be able to employ forensic tools to recover information 
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from his devices. In addition, as described further below, the Target Devices may include a 
variety of other stored communications, including voicemail, text message, and other third party 
messaging systems which^^^^^^^may have used to communicate with CORSI, STONE, 
and others regarding WikiLeaks. 

THE PERSON AND BAGGAGE TO BE SEARCHED CONTAIN EVIDENCE. FRUITS. 

AND INSTRUMENTALITIES 


67. I also have probable cause to believe that the person and baggage to be searched 
contains fruits, evidence, and instrumentalities of violations of the federal statutes listed above, 
as described in the warrants’ respective Attachments A and B. 



IIJl know from my training and experience that individuals often cany electronic devices and 
storage media of the type described in Attachment B with them when they travel both on their 
persons and in their baggage. These devices and media include but are not limited to cellular 


phones, tablets, laptops, thumb drives, CDs, DVDs, and external hard drives. 

69. From my training and experience, I am also aware that personal computer systems 
are generally capable of creating, receiving, and otherwise processing computer files such as e- 
mail, word-processing documents, photographs, and spreadsheets. As evidenced by the emails 
above,^^^^^^|uses computer systems to communicate with CORSI and STONE regarding 
WikiLeaks. 

70. Based on my training, experience, and information provided by other law 
enforcement officers, I know that many smartphones (which are included in Attachment B) can 
now function essentially as small computers. Smartphones have capabilities that include serving 
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as a wireless telephone, digital camera, portable media player, GPS navigation device, sending 
and receiving text messages and e-mails, and storing a vast range and amount of electronic data. 
Examining data stored on devices of this type can uncover, among other things, evidence that 
reveals or suggests who possessed or used the device. 

71. Based on my knowledge, training, experience, and information provided to me by 

other agents, I know that computer files or remnants of such files can be recovered months or 
years after they have been written, downloaded, saved, deleted, or viewed locally or over the 
Internet. This is true because: 

• Electronic files that have been downloaded to a storage medium can be stored for 
years at little or no cost. Furthermore, when users replace their computers, they 
can easily transfer the data from their old computer to their new computer. 

• Even after files have been deleted, they can be recovered months or years later 
using forensic tools. This is so because when a person “deletes” a file on a 
computer, the data contained in the file does not actually disappear; rather, that 
data remains on the storage medium until it is overwritten by new data, which 
might not occur for long periods of time. In addition, a computer's operating 
system may also keep a record of deleted data in a “swap” or “recovery” file. 

• Wholly apart from user-generated files, computer storage media, in particular, 
computers’ internal hard drives, contain electronic evidence of how the computer 
has been used, what it has been used for, and who has used it. This evidence can 
take the form of operating system configurations, artifacts from operating system 
or application operation, file system data structures, and virtual memory “swap” 
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or paging files. It is technically possible to delete this information, but computer 
users typically do not erase or delete this evidence because special software is 
typically required for that task. 

• Similarly, files that have been viewed over the Internet are sometimes 

automatically downloaded into a temporary Internet directory or “cache.” The 
browser often maintains a fixed amount of hard drive space devoted to these files, 
and the files are overwritten only as they are replaced with more recently viewed 
Internet pages or if a user takes steps to delete them. 

CONCLUSION 

72. Based on the forgoing, there is probable cause to believe that one or more people 
have violated the statutes specified above and that electronic devices and media containing 
evidence, fruits, and instrumentalities of those crimes, are contained on the person of 
^^^^^^^described further in that warrant’s Attachment A) and his baggage (described 
further in that warrant’s Attachment A), and for the seizure of the electronic devices and media 
described in further in Attachment B. 

REQUEST FOR AUTHORIZATION TO EXECUTE THE WARRANTS BEFORE 

6 AM OR AFTER 10 PM 

73. In addition, I request that the search warrants authorize searches and seizures 
before 6 AM and after 10 PM. Although^^^^^^^J flight is scheduled to land a fHH|||[ 

I am aware that flight departure and arrival times can vary widely from those announced 
because of adverse weather or other delays throughout the airline transportation system. If 
because of a flight delay ^^^^^^^Hflight landed at 10:01 PM, a warrant without the 
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requested authorization could not be executed for another 8 hours, requiring me to either obtain a 
new warrant or to detain and his baggage until 6 AM the next morning. The 

requested authorization will allow the searches and seizures to progress as efficiently as possible, 
with minimal delay to and any other person with whom he is travelling. 

REQUEST FOR SEALING 


74. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Sworn to under the pains and penalties of perjury, 



Curtis Heide 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 27th day of March 2018. 



llflr f&WU 


he Honorable. Marianne B. Bowler ‘ 


\ 


Kjl 


United States Magistrate Judge 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

j 

Case: 1:18-sc-02401 
Assigned To : Howell, Beryl A. 

Assign. Date : 7/12/2018 
Description: Search & Seizure Warrant 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of __ _ California _ 

(identify the person or describe the property to be searched and give its location)l 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 



See Attachment C. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment D. 


YOU ARE COMMANDED to execute this warrant on or before _ July 26, 2018 _ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. d at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to___ Hon. Beryl A. Howell _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) O until, the facts justifying, the later specific date of_. 


Date and time issued: 




City and state: Washington, DC 


Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Case No.: 


Return 

Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT C 


Property to be Searched 

This warrant applies to information associated with the following Apple account: 



that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at 
One Apple Park Way, Cupertino, California 95014. 
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ATACHMENT D 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment A: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers. Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps). My Apple ID and iForgot logs, sign-on logs for all Apple services. Game Center logs. 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other i nformation necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolisttxt files). 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15,2016 to November 10,2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to hacked material; 

b. All records, information, documents or tangible material^ha^ulat^^mv way to 

communications or meetings involving Roger Stone, Julian 

Assange, or any individual associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, and 
contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, 
used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 

j. All “address books” or other lists of contacts. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



CI 1 2 2018 


IN THE MATTER OF THE SEARCH OF 

fED WITH 



Case: 1:18-sc-02401 
Assigned To : Howell, Beryl A. 

Assign. Date: 7/12/2018 
Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Apple, Inc. (“Apple”) an electronic communication and/or remote computing 
service headquartered at a company headquartered at 1 Infinite Loop, Cupertino, CA not to 
disclose the existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Apple and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 



THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 
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AO 106 (Rev. 04/10) Application Tor a Search Warrant 


United States District Court 

for the 

District of Columbia 



JUL 1 2 2018 




In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 
iNFORMATION ASSOCIATED WITH 


) Case: 1:18-SC-02401 

) Assigned To : Howell, Beryl A. 

) Assign. Date : 7/12/2018 

) Description: Search & Seizure Warrant 

) 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment C. 

located in the_ Northern District of __ California __ , there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment D. 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more): 
sf evidence of a crime; 

(?f contraband, fruits of crime, or other items illegally possessed; 
sT property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §371 Conspiracy 

18 U.S.C. § 1030 Unauthorized Access of a Protected Computer 


The application is based on these facts: 

See attached Affidavit. 

$ Continued on the attached sheet. 

□ Delayed notice of_ days (give exact ending date if more than 30 days: 

under 18 U.S.C. § 3103a, the basis of which is set forth on theattachgd- sheet 

Applicant’s signature 

Andrew Mitchell, Special Agent, FBI 
Printed name and title 


Date: 7/12/2018 


Hon. Beryl A. Howell, C hief U.S. District Judge 

Printed name and title 



Reviewed by AUSA/SAUSA: 



Sworn to before me and signed in my presence. 



City and state: Washington, D.C, 
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IN THE UNITED STATES DISTRICT COURT JUL 1 2 2018 

FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy 

Courts for the District of Columbia 

IN THE MATTER OF THE SEARCH OF 

INFORMATION ASSOCIATED WITH Case No. / % - SC - ZV'°f 

Filed Under Seal 



AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for 

information associated with the following: 

a. The email account ^^^^^^^^^^^^naintained by CSC Holdings (“Target 
Account 1”), described further in Attachment A. 

b. The Apple Account (including email) associated with^^^^^^^^^^J, maintained 
by Apple, Inc. (Target Account 2), described further in Attachment C. 

c. The email accoun^^^^^^^^^^^maintained by Windstream Communications 
(“Target Account 3”), described further in Attachment E. 

The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream 
Communications (“the Providers”) and searched by the government is described in the following 
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a 
search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. Asa Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Before the submission of this warrant application, the Special CounseTs Office 
complied with all relevant Department of Justice policies, including the requirement for 
Departmental approval under the Department’s policy regarding obtaining information from 
members of the news media, 28 C.F.R. 50.10. 

5. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C. § 1030 (unauthorized access of a 
protected computer). 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) ... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 19. 

SUMMARY 

7. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get to 
Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emailsf.]” On or about July 
31,2016, STONE also instructed CORSI to have ^^^^^^^^^^^ftontact Julian 


2 
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ASSANGE. On or about August 2,2016, CORSI responded to STONE that the “word is friend 
in embassy [ASSANGE] plans 2 more dumps. One shortly after I’m back. 2nd in October. 
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w 
enemy if they are not ready to drop HRC.” After receipt of that message, on or about August 21, 
2016, using @RogerJStoneJR, Stone tweeted: “Trust me, it will soon the [sic] Podesta’s time in 
the barrel. #CrookedHillary.” 

8. Information disclosures subsequently occurred on or about the times CORSI 
predicted: On or about August 12,2016, the day CORSI was scheduled to return to the United 
States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
Democratic Congressional Campaign Committee (DCCC). On or about October 7,2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Tramp making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

9. Furthermore, on the day of the Access Hollywood video disclosure, there were 
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to 
publication. At approximately 11:00AM, the Washington Post received a tip regarding the 
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received 
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE 
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the 
two spoke again at length. At approximately 4:00PM, the Washington Post published its story 
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its 
first release of emails hacked from John Podesta. 


3 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 

i. Roger STONE 

11. Roger STONE is a self-employed political strategist/consultant and has been 

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 

ii. Jerome CORSI 


4 









Case l:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 14 of 58 


12. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau ChiefforInforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of j 

books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 


B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 
Hacking Activity during the 2016 Presidential Election 


5 
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14. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following, with emphasis added: 

15. The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

16. On January 6,2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

17. “Russian President Vladimir Putin ordered an influence campaign in 2016 aimed 
at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

18. The USIC also described, at a high level, some of the techniques that the Russian 
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government employed during its interference. The USIC summarized the efforts as a “Russian 
messaging strategy that blends covert intelligence operations—such as cyber activity—-with 
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, 
and paid social media users or ‘trolls.’” 

19. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities to 
the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted in 
the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” The GRU is the 
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia’s largest 
foreign intelligence agency. 

20. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

21. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

22. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1,2016. 
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23. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

24. On or about September 4,2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

25. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

D. Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks 

26. On June 14,2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikilcaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

27. On July 22,2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

28. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
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“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in 
the article and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains 
who he is and why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a 
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now 
the world would see for themselves how the Democrats had rigged the game.” 

29. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

30. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

31. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

32. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

33. On August 18,2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

34. On August 21,2016, using @RogerJStoneJR, Stone tweeted stating: “Trust me, it 
will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that 
same day, Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

35. On September 16,2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly basis 
fairly soon. And that of course will answer the question as to what exactly what was erased on 
that email server.” 

36. On Saturday, October 1,2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

37. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
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tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of WikiLeaks’ 10-year anniversary celebration - Stone told Info wars that his 
intermediary described this release as the “mother load.” On October 5, 2016, Stone used 
@RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

38. On Friday, October 7,2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

39. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

40. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8,2016. On October 12,2016, John Podesta - referring back to Stone’s August 
21,2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption 
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his 
emails] and the Tiump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the NBC News, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 
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41. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 

42. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 

43. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

44. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

45. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctV me the more people think you're lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 
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46. On or about November 9,2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

47. In addition, @RogerJStoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4,2017, @RogerJ Stone Jr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

48. On Saturday, June 10,2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

F. CORSI’s Communications with STONE, ^^^^^^^|and Others Regarding 
Forthcoming Leaks. 
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49. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 

issued a search warrant for STONE’s address, On October 

17,2017, Chief Judge Beryl A. Howell issued a search warrant for STONE’s ^^Jaddress, 

On or about December 19, 2017 Chief Judge Beryl A. Howell issued a 
search warrant for^^^^^^^^mail account. On or about March 14, 2018, Chief Judge Beryl 
A. Howell issued a search warrant for STONE’s iCloud account, Information recovered pursuant 
to those search warrants indicated the following: 

50. On or about May 15, 2016.^^^^^^|emailed CORSI at Target Account 3: 
“Here is my flight schedule. Need to get something confirmed now....” CORSI responded, “I 
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week.” 
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, “May 
meet Manafort -guarantee nothing.” 

51. On or about May 16, 2016,^^^^^^^mailed CORSI on Target Account 3: 
“Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things? 
Flexible re DJT. How about the head of finance for them?” CORSI responded, “I will work on 
other meetings today.”^^^^^^|replied, “Do you [want] me to bring you anything from the 
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!” 

52. On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE 

with the Title, “Roger — why don’t you look this over before I send it I believe that 

CORSI 

I did manage to see Mr. Tramp for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 
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53. On July 25,2016, STONE sent an email to CORSI at Target Account 1 with the 
subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t Ecuadorian 
Embassy in London and get the pending WikiLeaks emails.. .they deal with Foundation, 
allegedly.” 

54. On or about July 31 , 201 6 , STONE emailed CORSI at Target Account 1 with the 

subject line, “Call me MON.” The body of the email read: should see Assange[.] 

■■should find Bernie [Sjanders brother who called Bill a Rapist - turn him for Trump[.] 

should find more proof of Bill getting kicked out.” 

55. On or about August 2,2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE using Target Account 1, 
“Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact 
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup 
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of 
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre¬ 
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not 
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start 
suggesting HRC old, memory bad, has stroke — neither he nor she well. I expect that much of 
next dump focus, setting stage for Foundation debacle.” Investigators believe that CORSE s 
reference to a “friend in embassy [who] plans 2 more dumps” refers to Julian ASSANGE, the 
founder of WikiLeaks, who resided in Ecuador’s London Embassy in 2016. 

56. On or about August 5,2016, an associate of STONE’s, emailed 

him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded “enjoy it 
while u can[.] I dined with my new pal Julian Assange last night. ”^^^^^^|subsequently 
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stated to investigators that, around the same time, STONE told him he had gone to London to 
meet ASSANGE.stated that in 2018,^^^^^^|told STONE he would be 

interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE. 

) 

STONE told he was joking and had not actually met Assange. 

57. On or about August 15, 2016, CORSI messaged STONE using Target Account 
3: “Give me a call today if you can. Despite MSM dramroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

58. On or about August 31,2016, CORSI using Target Account 1 emailed STONE: 
“Did you get the PODESTA writeup.” STONE replied “yes.” 

59. On or about August 31,2016, CORSI, using Target Account 2, messaged 
STONE, “Podesta paid $ 180k to invest in Uranium One - was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

60. On or about September 6,2016, CORSI emailed STONE using Target Account 
3: “Roger[,j Is NY Post going to use the Pedesta [sic] stuff?” 

61. On or about September 24,2016, ^^^^^Jemailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded using Target 
Account 3, “We have secure back channel through Roger. I saw him again in NYC last Friday 
and spoke to him about it again today.”^^^^^^^vrote back, “Awaiting secret file. 
Explosive... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!” CORSI 
responded, “Keep me posted about file[.]” In a subsequent meeting with investigators, 
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indicated this conversation concerned possible derogatory information he was trying 
to obtain from Turkey. 

62. On or about October 3,2016, an associate of STONE emailed STONE and asked: 
“Assange - what’s he got? Hope it’s good.” Stone wrote back, “It is. I’d tell Bannon but he 
doesn’t call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be 
settled.” The associate forwarded the email to Steve BANNON and wrote: “You should call 
Roger. See below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to 
worry about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

63. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

64. On or about October 4, 2016, CORSI messaged STONE using Target Account 2, 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

65. That same day, BANNON emailed STONE, “What was that this morning???” 

STONE replied, “Fear. Serious security concern. He thinks they are going to kill him and the 
London police are standing done [sic]. “ BANNON wrote back, “He didn’t cut deal w/ 
Clintons???” Stone replied, “Don’t think so BUT his lawyer a big democrat.” 
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66. When BANNON spoke with investigators during a voluntary proffer on February 
14,2018, he initially denied knowing whether the October 4,2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

67. According to a publicly available news article, 1 at approximately 11AM on 
Friday, October 7,2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to tire same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 
2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling 
Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 

68. According to phone records at approximately 

11:27 AM, CORSI placed a call to STONE which STONE did not answer. 

69. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

70. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

71. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 ld74714-8ce5-1 le6-875e-2c 1 bfe943b66_story.html 
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72. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

73. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote “I 
expect that much of next dump focus, setting stage for Foundation debacle.” 

74. At approximately 6:27PM, sent STONE an email titled, 

“WikiLeaks — The Podesta Emails” with a link to the newly-released Podesta emails. 
Approximately ten minutes later, STONE forwarded message to CORSI at Target 

Account 1 without comment. STONE does not appear to have forwarded the email to any other 
individual. 

H. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 

STONE Is Accused of Advance Knowledge of the Leak 

75. On or about October 8, 2016, STONE messaged CORSI at Target Account 2, 
“Lunch postponed - have to go see T.” CORSI responded to STONE, “Ok. I understand.” 
Approximately twenty minutes later, CORSI texted, “Clintons know they will lose a week of 
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech 
comments, attacking bad job numbers.” 

76. On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE 
emailed CORSI at Target Account 1, asking him to “send me your best podesta links.” STONE 
emailed CORSI at approximately 8:$$ EDT, “need your BEST podesta pieces.” CORSI wrote 
back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on Podesta is 
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complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it's easy to understand will take weekend. Your choice?” 

77. On or about that same day October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI, 
using Target Account 1, emailed STONE with a subject line “Podesta talking points.” Attached 
to the email was a file labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The 
“talking points” included the statement that “Podesta is at the heart of a Russian-govemment 
money laundering operation that benefits financially Podesta personally and the Clintons through 
the Clinton Foundation.” 

78. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

79. On or about Thursday, October 13,2016, CORSI. using Target Account 3, 
emailed STONE: “PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote 
back to STONE, ‘Til give you one more — NOBODY YET HAS THIS[:] It looks to me like 

Jskimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.J The Russians launched a criminal investigation!.] [web link] O nce |^^H 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 


20 



Case l:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 30 of 58 


Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

80. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email with the Subject, “ROGER STONE article RUSSIAN MAFIA STYLE 
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA.” The text 
stated: “Roger[,J You are free to publish this under your own name.” That same day, STONE 
posted a blog post with the title, “Russian Mafia money laundering, the Clinton Foundation and 
John Podesta.” In that post, STONE wrote, “although I have had some back-channel 
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I 
have I ever received documents or data from Wikileaks.” The post then asked, “Just how much 
money a controversial Russian billionaire investor with ties to the 

Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional 
bank owned 99.978 percent by with the money transferred via Deutsche Bank and 

Trust Company Americas in New York City, with the money ending up in a private bank 
account in the Bank of America that is operated by the Clinton Foundation?” 

81. On or about October 14, 2016, CORSI sent a message using Target Account 2 to 
STONE, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

82. On or about October 17,2016, CORSI messaged STONE using Target Account 
2, “On Assange, can you call me now—before 2pm[,]” STONE responded, “Missed u - just . 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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83. On or about October 17,2016, CORSI, using Target Account 1, emailed STONE 
with the subject, “Fwd: ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted source,” 
and forwarded an email with the header information stripped out, showing only the body text. 
The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will 
drop the goods on them if they move to extr adite him. My guess is that he has a set of dead man 
files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if 
Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If 
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He’s 
called Podesta’s bluff and raised him the election.” 

84. On or about October 18, 2016, CORSI messaged STONE using Target Account 
2, “Pis call. Important.” 

85. On or about October 19,2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

86. On or about November 8,2016, the United States presidential election took place. 

87. On or about November 9, 2016, CORSI, using Target Account 2, messaged 
STONE, “Congratulations, Roger. He could not have done it without you.” 

88. On or about November 10, 2016, CORSI messaged STONE using Target 
Account 2, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m 
in London. Have some interesting news for you.” 
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BACKGROUND CONCERNING EMAIL 

96. In my training and experience, I have learned the Providers provide a variety of 
on-line services, including electronic mail (“email”) to the public. The Providers allow 
subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

97. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

98. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
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information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

99. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user of users. 

100. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
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occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

101. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 
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INFORMATION REGARDING APPLE ID AND iCLOUD 2 

102. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 
the Mac OS operating system. 

103. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

• Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

• iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

• iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-comiected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 


2 The information in this section is based on information published by Apple on its website, including, but 

not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/privacv/docs/leeal-process-euidelines-us.pdf : “Create and start using an Apple ID,” 
available at https://support.apple.com/en-us/HT203993: “iCloud,” available at http://www.apple.com/icloud/ : “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH 12519 : “iOS Security,” available at 
https://www.apple.com/business/docs/iOS Security Guide.pdf. and “iCloud: How Can 1 Use iCloud?,” available at 
https://support.apple.com/kb/PH26502 . 
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• iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 
to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

• Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

• Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

• Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

• App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
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through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 

104. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

105. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

106. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
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the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 

107. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

108. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access seivices through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
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communications regarding a particular Apple device or service, and the repair history for a 
device. 

109. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 
nonetheless be decrypted by Apple. 

110. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. 


32 




Case l:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 42 of 58 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

111. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

112. Based on the forgoing, I request that the Court issue the proposed search warrant. 

113. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 

114. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Andrew Mitchell 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 


/A 


day of July, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following email account: 

1 . 

that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC, 
1111 Stewart Avenue, Bethpage, NY 11714. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I. A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the accoimt described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, accoimt status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15,2016 to November 10,2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate i n any way to 

communications or meetings involving Roger Stone, Julian Assange, or 

any individual associated with the Trump Campaign; 

All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

c. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

d. Evidence of the times the account was used; 

e. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories identified in 
subsection II.A; 
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ATTACHMENT C 
Property to be Searched 

This warrant applies to information associated with the following Apple account: 

that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at 
One Apple Park Way, Cupertino, California 95014. 
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ATACHMENT D 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment A: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses. Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including Messages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. ' The contents of all files and other records stored on iCloud, including all iOS 

device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services. Game Center logs. 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15,2016 to November 10, 2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materialsUhaUelat^rumy way to 

communications or meetings involving Roger Stone, Julian 

Assange, or any individual associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, and 
contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, 
used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories 
identified in subsection II. A; and 

j. All “address books” or other lists of contacts. 
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ATTACHMENT E 
Property to be Searched 

This warrant applies to information associated with the following email account: 

that is stored at premises owned, maintained, controlled, or operated by Windstream 
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock, 
Arkansas, 72211. 
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ATTACHMENT F 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment E: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section LA, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Attachment E; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and ail records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10,2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, infonnation, documents or tangible materials that relate in any way to 

communications or meetings involving Roger Stone, Julian Assange, or 

any individual associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified 
above; 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 


Case: 1:18-sc-02401 
Assigned To : Howell, Beryl A. 

Assign. Date : 7/12/2018 
Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(E) 

The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Apple Inc. (“Apple”) an electronic communication 
and/or remote computing services provider headquartered in Cupertino, California not to notify 
any other person (except attorneys for Apple for the purpose of receiving legal advice) of the 
existence or content of the Warrant for a period of one year or until further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 


1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard , 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States ... that - has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the 
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Apple provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Apple may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [.v/c] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena UGJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Apple not to notify any other person (except attorneys for Apple for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. At the present time, law enforcement officers of the FBI are conducting an 
investigation into violations related to 18 U.S.C. § 1030 (unauthorized access of a protected 
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome 
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and 
scope of the ongoing FBI investigation. Disclosure of this warrant to Corsi could lead him to 
destroy evidence or notify others who may delete information relevant to the investigation. 
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REQUEST FOR SEALING AND NON-DISCLOSURE 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Apple and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither 
public nor known to the targets of the investigation, and its disclosure may alert these targets to 
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would 
be immediately prompted to destroy or conceal incriminating evidence, alter their operational 
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid 
future prosecution. In particular, given that they are known to use electronic communication and 
remote computing services, the potential target could quickly and easily destroy or encrypt digital 
evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief: 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson^ 935 F.2d at 287-89. 


10. Based on prior dealings with Apple the United States is aware that, absent a court 
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, it is 
Apple’s policy and practice, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, to notify the subscriber or customer of 
the existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Apple not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 

Respectfully submitted, 


Dated: WV7M# 


By: 


ROBERT S. MUELLER, III 
Special Counsel 



mron S.J. ZeliqSKy 
The Special Counsel’s Office 
(202)-514-0637 
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AO 93 (Rev, 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

Case: 1:18-sc-02403 
Assigned To : Howell, Beryl A. 

Assign. Date : 7/12/2018 
Description: Search & Seizure Warrant 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ East ern _ District of _ New York 

(identify the person or describe the property to be searched and give its location): 

See Attachment A 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INF ORMATION ASSOCIATED WIT H ) 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before . July 26, 2018 _ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to__Hon. Bery l A. Howell _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for _days (not to exceed 30 ) □ until, the facts justifying, the later specific date of_. 

Date and time issued: ?// _ 

Judge’s signature 

City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 






Case l:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 2 of 57 


AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



_ Certification ___ 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date:___ _______ 

Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following email account: 

1 . 

that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC, 
1111 Stewart Avenue, Bethpage, NY 11714. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section l.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section T.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10,2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materiakUhaUelate in any way to 

communications or meetings involving Roger Stone, Julian Assange, or 

any individual associated with the Trump Campaign; 

All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

c. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

d. Evidence of the times the account was used; 

e. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories identified in 
subsection II.A; 


36 
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IN THE UNITED STATES DISTRICT COURT JUL 1 2 2018 

FOR THE DISTRICT OF COLUMBIA Clerki U-S . Dlstrict & Bankruptcy 

Courts for the Distrist of Columbia 


IN THE MATTER OF THE SEARCH OF 
1ATION ASSOCIATED WITH 



Case: 1:18-sc-02403 
Assigned To : Howell, Beryl A. 

Assign. Date: 7/12/2018 
Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require CSC Holdings, an electronic communication and/or remote computing service s 
headquartered at 1111 Stewart Avenue, Bethpage, NY 11714, not to disclose the existence or 
contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), CSC Holdings and 
its employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for CSC Holdings for the purpose of receiving legal advice) for a period of one year 
unless otherwise ordered by the Court. 


THE HONORABLE &ERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 



2 
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AO 106 (Rev. 04/10) Application for a Search Warrant 

United States District Court 

for the 

District of Columbia 



JUL 1 2 2018 


Clerk, Ll.S. District & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 



) Case: 1:18-SC-02403 
j Assigned To : Howell, Beryl A. 

) Assign. Date : 7/12/2018 
) Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A. 

located in the Eastern District of_ New York , there is now concealed (identify the 

person or describe the property to be seized ): 

See Attachment B. 

This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §371 Conspiracy 

18 U.S.C. § 1030 Unauthorized Access of a Protected Computer 

The application is based on these facts: 


See attached Affidavit. 


0 Continued on the attached sheet. 

□ Delayed notice of _ days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached_sheet. 


Reviewed by AUSA/SAUSA: 


) is requested 



Aaron Zelinsky (ASC) 


Applicant's signature 
Andrew Mitchell, Special Agent, FBi 


Printed name and title 


Sworn to before me and signed in my presence. 

Date: 7/12/2018 

City and state: Washington, D.C. _ 



Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


JUL 1 2 2018 

Clerk, U.S. District & Bankruptcy 
Courts for tiro District of Columbia 


IN THE MATTER OF THE SEARCH OF 



Case No. 5^ *7.Yo3 

Filed Under Seal 


AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

1, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the following: 

a. The email account ^^^^^^^^^^^^naintained by CSC Holdings (“Target 
Account 1”), described further in Attachment A. 

b. The Apple Account (including email) associated with ^^^^^^^^^^^maintained 
by Apple, Inc. (Target Account 2), described further in Attachment C. 

aintained by Windstream Communications 
(“Target Account 3”), described further in Attachment E. 

The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream 
Communications (“the Providers”) and searched by the government is described in the following 
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a 
search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. Asa Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Before the submission of this warrant application, the Special Counsel’s Office 
complied with all relevant Department of Justice policies, including the requirement for 
Departmental approval under the Department’s policy regarding obtaining information from 
members of the news media, 28 C.F.R. 50.10. 

5. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C, § 1030 (unauthorized access of a 
protected computer). 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), 8c (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 19. 

SUMMARY 

7. On or about July 25,2016, Roger STONE emailed Jerome CORSI to “Get to 
Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” On or about July 
31,2016, STONE also instructed CORSI to have ^^^^^^^^^^^^|contact Julian 
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ASSANGE. On or about August 2, 2016, CORSI responded to STONE that the “word is friend 
in embassy [ASSANGE] plans 2 more dumps. One shortly after I’m back. 2nd in October. 
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w 
enemy if they are not ready to drop HRC.” After receipt of that message, on or about August 21, 
2016, using @RogerJStoneJR, Stone tweeted: “Trust me, it will soon the [sic] Podesta’s time in 
the barrel. #CrookedHillary.” 

8. Information disclosures subsequently occurred on or about the times CORSI 
predicted: On or about August 12,2016, the day CORSI was scheduled to return to the United 
States (“shortly after Pm back”), Guccifer 2.0 released hacked information related to the 
Democratic Congressional Campaign Committee (DCCC). On or about October 7,2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

9. Furthermore, on the day of the Access Hollywood video disclosure, there were 
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to 
publication. At approximately 11:00AM, the Washington Post received a tip regarding the 
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received 
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE 
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the 
two spoke again at length. At approximately 4:00PM, the Washington Post published its story 
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its 
first release of emails hacked from John Podesta. 


3 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 

i. Roger STONE 

11. Roger STONE is a self-employed political strategist/consultant and has been 

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 

it Jerome CORSI 


4 







Case l:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 13 of 57 


12. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Infoiwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 


B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 
Hacking Activity during the 2016 Presidential Election 


5 
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14. On October 7,2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following, with emphasis added: 

15. The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

16. On January 6,2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

17. “Russian President Vladimir Putin ordered an influence campaign in 2016 aimed 
at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigr ate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

18. The USIC also described, at a high level, some of the techniques that the Russian 
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government employed during its interference. The USIC summarized the efforts as a “Russian 
messaging strategy that blends covert intelligence operations—such as cyber activity—with 
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, 
and paid social media users or ‘trolls.’” 

19. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities to 
the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted in 
the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” The GRU is the 
foreign military intelligence agency of the Russian Ministiy of Defense, and is Russia’s largest 
foreign intelligence agency. 

20. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

21. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

22. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1,2016. 
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23. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

24. On or about September 4,2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

25. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

D. Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks 

26. On June 14,2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15,2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

27. On July 22,2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

28. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
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“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in 
the article and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains 
who he is and why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a 
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now 
the world would see for themselves how the Democrats had rigged the game.” 

29. On August 8,2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intennediary. 

30. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2,0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

31. On August 13,2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

32. On August 17,2016, Guccifer 2.0 publicly tweeted, “@RogerJStone Jr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

33. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

34. On August 21,2016, using @RogerJStoneJR, Stone tweeted stating: “Trust me, it 
will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that 
same day, Stone reiterated that because of the work of a ‘“mutual acquaintance’ of both his and 
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

35. On September 16,2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly basis 
fairly soon. And that of course will answer the question as to what exactly what was erased on 
that email server.” 

36. On Saturday, October 1,2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

37. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
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tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement - 
which was part of WikiLeaks’ 10-year anniversary celebration - Stone told Infowars that his 
intermediary described this release as the “mother load.” On October 5,2016, Stone used 
@RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

38. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

39. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

40. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8,2016. On October 12,2016, John Podesta - referring back to Stone’s August 
21,2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption 
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the NBC News, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 
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41. On March 27,2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be imiocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 

42. On August 7,2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 

43. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

44. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

45. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you're lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 
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46. On or about November 9,2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

47. In addition, @RogerJStoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4,2017, @RogerJStoneJr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

48. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

F. CORSI’s Communications with STONE, Others Regarding 

Forthcoming Leaks. 
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49. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 

issued a search warrant for STONE’s address, On October 

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE’s^^^J address, 

On or about December 19,2017 Chief Judge Beryl A. Howell issued a 
search warrant for ^^^^^^Jemail account. On or about March 14,2018, Chief Judge Beryl 
A. Howell issued a search warrant for STONE’s iCloud account. Information recovered pursuant 
to those search warrants indicated the following: 

50. On or about May 15,2016, emailed CORSI at Target Account 3: 

“Here is my flight schedule. Need to get something confirmed now....” CORSI responded, “I 
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week.” 
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, “May 
meet Manafort -guarantee nothing.” 

51. On or about May 16,2016, ^^^^^^^mailed CORSI on Target Account 3 : 
“Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things? 
Flexible re DJT. How about the head of finance for them?” CORSI responded, “I will work on 
other meetings today.”^^^^^^^eplied, “Do you [want] me to bring you anything from the 
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!” 

52. On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE 
with the Title, “Roger — why don't you look this over before I send it^^^^^^|l believe that 

CORSI 

|m^^m^and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 
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53. On July 25,2016, STONE sent an email to CORSI at Target Account 1 with the 
subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t Ecuadorian 
Embassy in London and get the pending WikiLeaks emails.. .they deal with Foundation, 
allegedly.” 

54. On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the 
subject line, “Call me MON.” The body of the email read: ‘^^^^fshould see Assange[.] 

should find Bernie [Sjanders brother who called Bill a Rapist - turn him for Trump[.] 
^^^should find more proof of Bill getting kicked out.” 

55. On or about August 2,2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE using Target Account 1, 
“Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact 
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup 
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of 
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre¬ 
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not 
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start 
suggesting HRC old, memory bad, has stroke — neither he nor she well. I expect that much of 
next dump focus, setting stage for Foundation debacle.” Investigators believe that CORSI’s 
reference to a “friend in embassy [who] plans 2 more dumps” refers to Julian ASSANGE, the 
founder of WikiLeaks, who resided in Ecuador’s London Embassy in 2016. 

56. On or about August 5, 201an associate of STONE’s, emailed 
him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded “enjoy it 
while u can[.] I dined with my new pal Julian Assange last night.”^^^^^^|subsequently 
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stated to investigators that, around the same time, STONE told him he had gone to London to 
meet ASSANGE.^^^^^^^lso stated that in 2018,^^J^^Jtold STONE he would be 
interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE. 
STONE told^^^^^^|he was joking and had not actually met Assange. 

57. On or about August 15, 2016, CORSI messaged STONE using Target Account 
3: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry." 

58. On or about August 31,2016, CORSI using Target Account 1 emailed STONE: 
“Did you get the PODESTA writeup.” STONE replied “yes.” 

59. On or about August 31,2016, CORSI, using Target Account 2, messaged 
STONE, “Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych — Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

60. On or about September 6, 2016, CORSI emailed STONE using Target Account 
3: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

61. On or about September 24,2016.^^^^^^|emailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded using Target 
Account 3, “We have secure back channel through Roger. I saw him again in NYC last Friday 
and spoke to him about it again today.”^^^^^^^vrote back, “Awaiting secret file. 
Explosive... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!” CORSI 
responded, “Keep me posted about file[.]” In a subsequent meeting with investigators, 
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indicated this conversation concerned possible derogatory information he was trying 
to obtain from Turkey. 

62. On or about October 3, 2016, an associate of STONE emailed STONE and asked: 
“Assange - what’s he got? Hope it’s good.” Stone wrote back, “It is. I’d tell Bannon but he 
doesn’t call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be 
settled.” The associate forwarded the email to Steve BANNON and wrote: “You should call 
Roger. See below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to 
worry about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

63. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

64. On or about October 4, 2016, CORSI messaged STONE using Target Account 2. 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

65. That same day, BANNON emailed STONE, “What was that this morning???” 
STONE replied, “Fear. Serious security concern. He thinks they are going to kill him and the 
London police are standing done [sic]. “ BANNON wrote back, “He didn’t cut deal w/ 
Clintons???” Stone replied, “Don't think so BUT his lawyer^^^l is a big democrat.” 
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66. When BANNON spoke with investigators during a voluntary proffer on February 
14,2018, he initially denied knowing whether the October 4,2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

G. STONE and CORSI Communications on October 7,2016, when the Podesta Emails 

Are Released. 

67. According to a publicly available news article, 1 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 
2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling 
Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 

68. According to phone records at approximately 

11:27 AM, CORSI placed a call to STONE which STONE did not answer. 

69. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

70. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

71. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 ld74714-8ce5-l 1 e6-875e-2cl bfe943b66_story.html 
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72. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

73. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote “I 
expect that much of next dump focus, setting stage for Foundation debacle.” 

74. At approximately 6:27PM,^^^^^^^^|sent STONE an email titled, 
“WikiLeaks - The Podesta Emails” with a link to the newly-released Podesta emails. 
Approximately ten minutes later, STONE forwarded ^^^^Jmessage to CORSI at Target 
Account 1 without comment. STONE does not appear to have forwarded the email to any other 
individual. 

H. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 

STONE Is Accused of Advance Knowledge of the Leak 

75. On or about October 8,2016, STONE messaged CORSI at Target Account 2, 
“Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I understand.” 
Approximately twenty minutes later, CORSI texted, “Clintons know they will lose a week of 
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech 
comments, attacking bad job numbers.” 

76. On or about Wednesday, October 12,2016, at approximately 8:17 EDT, STONE 
emailed CORSI at Target Account 1, asking him to “send me your best podesta links.” STONE 
emailed CORSI at approximately 8:$$ EDT, “need your BEST podesta pieces.” CORSI wrote 
back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on Podesta is 
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complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it's easy to understand will take weekend. Your choice?” 

77. On or about that same day October 12,2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI, 
using Target Account 1, emailed STONE with a subject line “Podesta talking points.” Attached 
to the email was a file labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The 
“talking points” included the statement that “Podesta is at the heart of a Russian-govemment 
money laundering operation that benefits financially Podesta personally and the Clintons through 
the Clinton Foundation.” 

78. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the^^^^^Account, “Got them and used them.” 

79. On or about Thursday, October 13,2016, CORSI, using Target Account 3, 
emailed STONE: “PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 


CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote 
back to STONE, “Ell give you one more — NOBODY YET HAS THIS[:] It looks to me like 
skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once^l^^^H 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

80. On or about Thursday, October 13,2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email with the Subject, “ROGER STONE article RUSSIAN MAFIA STYLE 
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA.” The text 
stated: “Roger[,] You are free to publish this under your own name.” That same day, STONE 
posted a blog post with the title, “Russian Mafia money laundering, the Clinton Foundation and 
John Podesta.” In that post, STONE wrote, “although I have had some back-channel 
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I 
have I ever received documents or data from Wikileaks.” The post then asked, “Just how much 
money did a controversial Russian billionaire investor with ties to the 

Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional 
bank owned 99.978 percent by with the money transferred via Deutsche Bank and 

Trust Company Americas in New York City, with the money ending up in a private bank 
account in the Bank of America that is operated by the Clinton Foundation?” 

81. On or about October 14,2016, CORSI sent a message using Target Account 2 to 
STONE, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

82. On or about October 17, 2016, CORSI messaged STONE using Target Account 
2, “On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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83. On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE 
with, the subject, “Fwd: ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted source,” 
and forwarded an email with the header information stripped out, showing only the body text. 
The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will 
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man 
files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if 
Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If 
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He’s 
called Podesta’s bluff and raised him the election.” 

84. On or about October 18, 2016, CORSI messaged STONE using Target Account 
2, “Pis call. Important.” 

85. On or about October 19,2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a co mm on friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

86. On or about November 8, 2016, the United States presidential election took place. 

87. On or about November 9,2016, CORSI, using Target Account 2, messaged 
STONE, “Congratulations, Roger. He could not have done it without you.” 

88. On or about November 10,2016, CORSI messaged STONE using Target 
Account 2, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m 
in London. Have some interesting news for you.” 
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BACKGROUND CONCERNING EMAIL 

96. In my training and experience, I have learned the Providers provide a variety of 
on-line services, including electronic mail (“email”) to the public. The Providers allow 
subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

97. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

98. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
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information can include the date on which the account was created, the length of service, records 
of log-in (/. e ., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

99. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

100. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
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occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime ( e.g ., 
communications relating to the crime), or consciousness of guilt ( e.g., deleting communications 
in an effort to conceal them from law enforcement). 

101. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 


27 



Case l:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 36 of 57 


INFORMATION REGARDING APPLE ID AND iCLOUD 2 

102. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 
the Mac OS operating system. 

103. Apple provides a variety of services that can be accessed lfom Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

• Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

• iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

• iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 


2 The information in this section is based on information published by Apple on its website, including, but 

not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/privacv/docs/legal-process-guidelines-us.Ddf: “Create and start using an Apple ID,” 
available at https://support.apple.com/en-us/HT203993 : “iCloud,” available at http://www.apple.com/icloud/ : “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH12519: “iOS Security,” available at 
https://www.apple.com/business/docs/iOS Security Guide.pdf. and “iCloud: How Can I Use iCloud?,” available at 
https://suPDort.apple.com/kb/PH26502 . 
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• iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icioud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 
to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

• Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

• Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

• Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

• App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
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through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 

104. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

105. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

106. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
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the account (including whether the account is inactive or closed), the methods used to comiect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 

107. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

108. Apple also ma intains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
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communications regarding a particular Apple device or service, and the repair history for a 
device. 

109. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call histoiy, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 
nonetheless be decrypted by Apple. 

110. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. 
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INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

111. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

112. Based on the forgoing, I request that the Court issue the proposed search warrant. 

113. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 

114. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 



Andrew Mitchell 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on 


this /^ day of July, 2018. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following email account: 

that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC, 
1111 Stewart Avenue, Bethpage, NY 11714. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the govermnent for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I. A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I. A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15,2016 to November 10,2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, ^^^^^^^^^^Jlulian Assange, or 
any individual associated with the Trump Campaign; 

All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

c. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

d. Evidence of the times the account was used; 

e. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

f. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

h. All existing printouts from original storage which concern the categories identified in 
subsection II. A; 
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ATTACHMENT C 
Property to be Searched 

This warrant applies to information associated with the following Apple account: 

that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at 
One Apple Park Way, Cupertino, California 95014. 
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ATACHMENT D 


Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(1), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment A: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”)? 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including Messages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all flies and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolisttxt files). 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15,2016 to November 10,2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materi^^l^^^^^h^w way to 

co mmuni cations or meetings involving Roger Stone, Julian 

Assange, or any individual associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, and 
contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, 
used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories 
identified in subsection II. A; and 

j. All “address books” or other lists of contacts. 
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ATTACHMENT E 


Property to be Searched 

This warrant applies to information associated with the following email account: 



that is stored at premises owned, maintained, controlled, or operated by Windstream 
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock, 
Arkansas, 72211. 
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ATTACHMENT F 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment E: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 

each e-mail was sent, and the size and length of each e-mail; | 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I. A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Attachment E; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and ail records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15,2016 to November 10,2016. 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone,^^^^^^^^^^Jlulian Assange, or 
any individual associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified 
above; 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 


Case: 1:18-sc-02403 
Assigned To : Howell, Beryl A. 

Assign. Date : 7/12/2018 
Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 

The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct CSC Holdings, an electronic communication and/or 
remote computing services provider headquartered in Bethpage, NY not to notify any other person 
(except attorneys for CSC Holdings for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard , 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282,287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States ... that - has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the 
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). CSC Holdings provides an “electronic communications service,” as defined in 
18 U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. §2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how CSC Holdings may 
be compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary. 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or com! order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S:C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [s/c] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ20J4031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command CSC Holdings not to notify any other person (except attorneys for CSC Holdings for 
the purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or 
until further order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. At the present time, law enforcement officers of the FBI are conducting an 
investigation into violations related to 18 U.S.C. § 1030 (unauthorized access of a protected 
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome 
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and 
scope of the ongoing FBI investigation. Disclosure of this warrant to Corsi could lead him to 
destroy evidence or notify others who may delete information relevant to the investigation. 
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' REQUEST FOR SEALING AND NON-DISCLOSURE 

7. In this matter, the government requests that the W arrant be sealed until further order 
of the Court and that CSC Holdings and its employees be directed not to notify any other person 
of the existence or content of the Warrant (except attorneys for CSC Holdings for the purpose of 
receiving legal advice) for a period of one year or until further order of the Court. Such an order 
is appropriate because the Warrant relates to an ongoing criminal investigation, the full scope of 
which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the ongoing investigation and its scope. Once alerted to this investigation, potential 
targets would be immediately prompted to destroy or conceal incriminating evidence, alter their 
operational tactics to avoid future detection, and otherwise take steps to undermine the 
investigation and avoid future prosecution. In particular, given that they are known to use 
electronic communication and remote computing services, the potential target could quickly and 
easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee horn prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with CSC Holdings the United States is aware that, absent 
a court order under Section 2705(b) commanding CSC Holdings not to notify anyone about a legal 
request, it is CSC Holdings’s policy and practice, upon receipt of a warrant seeking the contents 
of electronically stored wire or electronic communications for a certain account, to notify the 
subscriber or customer of the existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
CSC Holdings not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for CSC Holdings for the purpose of receiving legal advice) for a period 
of one year or until further order of the Court. 

Respectfully submitted, 

ROBERT S. MUELLER, III 
Special Counsel 

Dated: By: -_- 

Aaron S.J. Zelirisky 

The Special Qprfnsel’s Office 

(202)-514-0637 
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AO 93 (Rev 11/13) Search and Seizure Warrens 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: 1 : 18 -sc 02524 
Assigned To : Howell, Beryl A. 

Assign. Date : 7/27/2018 
nocrrintion: Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the No rt hern _ District of _ Califo rnia 

(identify the person or describe the property to be searched and give its location)'. 


See Attachment A 


1 find that the affldavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify' the person or describe the property to be seized)'. 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 10, 2018_ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. ft at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to_Hon. Ber yl A. Ho we ll, Chief U.S. Dis trict Jud ge_. 

(United States Magistrate Judge) 

ft Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property s will be searched or seized (check the appropriate box) 

ft for_days (not to exceed 30) ft until, the facts justifying, the later specific date of _ _ 

Date and time issued: ?'/£ T'/Jd) % _- 

r * Judge's signature 


City and state: Washing ton, DC 


Hon. Beryl A. H owell, Chief U.S. District J udge 

Printed name and title 
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AO 93 (Rev. 11/53) Search and Seizure Warrant (Page 2) 


Return 


Case No,: 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of: 

Inventory of the property taken and name of any person(s) seized: 


__ Certification _____ 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to search history information associated with the following accounts 
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain 


View, California; 
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ATTACHMENT B 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f). the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. All search history information associated with each account. 

II, Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present, 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 
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b. All records, information, documents or tangibJe material^hanelate in any way to 

communications or meetings involving Roger Stone, Julian Assange, or 

any individual associated with the Trump Campaign; 

e, Evidence indicating the account owner’s state of mind as it relates to the crimes under 
investigation; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Information, documentation and records relating to who created, used, or communicated 
with the account or identifier concerning the messages identified above, including records 
about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All evidence of wiping software, encryption or other methods to avoid detection by law 
enforcement; 

g. Evidence of passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

h. Evidence of credit card and other financial information, including but not limited to, bills 
and payment records evidencing ownership of the subject account; 


I. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team," separate and apart from the investigative team, in order to address potential privileges. 
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AO 106 (Rev 04/10) Application fora Search Warrant 


United States District Court 


for the 

District of Columbia 


JUL 2 7 2 


Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of ^ 

(Briefly describe llw property to be searched \ 

or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE ACCOUNTS { 
STORED AT PREMISES CONTROLLED BY GOOGLE j 

) 


Case: 1:18-sc-02524 
Assigned To : Howell, Beryl A. 

Assign. Date : 7/27/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Northern District of Califo rnia _ , there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §§ 2, 3, 4, 371 Aiding & Abetting, Accessory afierthe Fact, Misprision of a Felony, Conspiracy 

18 U.S.C. §§ 1030, 1343, 1349 Unauthorized Access of Protected Computer, Wire Fraud, Wre Fraud Conspiracy 
52 U.S.C. § 30121 Foreign Contribution Ban 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 


under 18 U.S.C. § 3103a, the basis of which is set forth on the altaph^cTsheet. 


) is requested 


Reviewed by AUSA/SAUSA: 



Kyle R. Freeny (ASC) 


Applicant’s signature 

Andrew Mitchell, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 
Date: 

City and state: Washington, D.C._ 



Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 



Case l:19-mc-00029-CRC Document 29-11 


Filed 04/28/20 



JUL 1 7 S0IO 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED AT 
PREMISES CONTROLLED BY GOOGLE 


Case; 1:18-sc-02524 
Assigned To : Howell, Beryl A 
Assign. Date : 7/27/2018 
Description: Search & Seizure 


Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for search 
history information associated with the following Google accounts 

(“Target Accounts”), stored at 
premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a business 
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. The 
information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments A and B. 

2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. Asa Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain information relevant to 
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violations of 18 U.S.C. § 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 
U.S.C. § 4 (misprision of a felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 
(attempt and conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) 
(the “Subject Offenses”). 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) ... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 19. 

SUMMARY 

6. The Special Counsel’s Office, with FBI’s assistance, is investigating the Russian 
government’s efforts to interfere in the 2016 presidential election, as well as any links and/or 
coordination between the Russian government and individuals associated with the campaign of 
President Donald Trump. This includes investigating Roger Stone (STONE) and others known 
and unknown, in connection with the hacking of email accounts associated with the Democratic 
National Committee (DNC), Democratic Congressional Campaign Committee (DCCC), and 
individuals involved in the presidential campaign of Hillary Clinton, as well as the subsequent 
dissemination of hacked materials via the persona Guccifer 2.0 and the organization WikiLeaks, 
among others. 
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7. On or about July 25, 2016, STONE emailed Jerome CORSI to “Get to Assange” 
at the Ecuadorian Embassy and “get pending WikiLeaks emailsf.]” On or about July 31, 2016, 
STONE also instructed CORSI to have^^^^^^^^^^^J contact Julian ASSANGE. On or 
about August 2, 2016, CORSI responded to STONE that the “word is friend in embassy 
[ASSANGE] plans 2 more dumps. One shortly after I’m back. 2nd in October. Impact planned 
to be very damaging.... Time to let more than Podesta to be exposed as in bed w enemy if they 
are not ready to drop HRC.” After receipt of that message, on or about August 21, 2016, using 
@RogerJStoneJR, Stone tweeted: “Trust me, it will soon the [sic] Podesta’s time in the barrel. 
#CrookedHi 1 lary.” 

8. Information disclosures subsequently occurred on or about the times CORSI 
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United 
States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the DCCC. 
On or about October 7, 2016, the day the Washington Post published a breaking story about an 
Access Hollywood videotape of then-candidate Trump making disparaging remarks about 
women, WikiLeaks released emails hacked from the account of John Podesta. 

9. Furthermore, on the day of the Access Hollywood video disclosure, there were 
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to 
publication. At approximately 11:00AM, the Washington Post received a tip regarding the 
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received 
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE 
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the 
two spoke again at length. At approximately 4:00PM, the Washington Post published its story 
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regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its 
first release of emails hacked from John Podesta. 



PROBABLE CAUSE 


A. Background on Relevant Individuals 

/. Roger STONE 

11. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
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Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 

ii. Jerome CORSI 

12. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


14. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 

the Director of National Intelligence released a joint statement of an intelligence assessment of 

Russian activities and intentions during the 2016 presidential election. In the report, the USIC 

assessed the following, with emphasis added: 

The U.S. Intelligence Community (USIC) is confident that the Russian Government 
directed the recent compromises of emails from US persons and institutions, including 
from US political organizations. The recent disclosures of alleged hacked emails on sites 
like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and 
disclosures are intended to interfere with the US election process. Such activity is not 
new to Moscow—the Russians have used similar tactics and techniques across Europe 
and Eurasia, for example, to influence public opinion there. We believe, based on the 
scope and sensitivity of these efforts, that only Russia’s senior-most officials could have 
authorized these activities. 

15. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

16. In its assessment, the USIC also described, at a high level, some of the techniques 

that the Russian government employed during its interference. The USIC summarized the efforts 

as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
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activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

17. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

18. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

19. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

20. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

21. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
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those accounts. 

22. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

23. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

24. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 
2016 presidential election, including conspiracy to commit authorized access to protected 
computers. (CaseNo. l:18-cr-00125). 

C. Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks 

25. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

26. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

27. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
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to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

28. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard 
to the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with ASSANGE. I believe the next tranche of his documents 
pertain to the Clinton Foundation but there’s no telling what the October surprise may be.” A 
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he 
had a close friend who served as an intermediary. 

29. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

30. On August 13, 2016, STONE posted a tweet using @RogerJStone Jr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

31. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
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back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

32. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted stating: “Trust me, 
it will soon the [sic] Podesta’s time in the barrel. //CrookedHillary.” In a C-SPAN interview 
that same day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both 
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in 
the form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think 
Julian Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. 

I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

34. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

35. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. //WikiLeaks.” 

36. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
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part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

39. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, John Podesta - referring back to STONE’s 
August 21, 2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable 
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the 
release of his emails] and the Trump campaign had advanced warning about what Assange was 
going to do. I think there’s at least a reasonable belief that [Assange] may have passed this 
information on to [STONE].” Commenting to the NBC News, STONE responded: “I have never 
met or spoken with Assange, we have a mutual friend who’s traveled to London several times, 
and everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

40. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
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communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

41. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

42. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

43. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctY' me the more people think you're lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

44. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 

1 On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter 
account @RogerJStoneJr. 
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@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate 
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen 
from the government and the courts ruled it was legal to do so and refused to issue an order 
restraining the paper from publishing additional articles. If the US government moves on you I 
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I 
don't know of any crime you need to be pardoned for - best regards. R.” That same day, 
@JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the DoJ side 
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us 
into a deal.” 

46. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with and Others Regarding 

Forthcoming Leaks 

47. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for STONE’s address^^^^^^^^^^^^^J On October 

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE’^^^^B 
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addresses, On or about December 19, 2017, Chief Judge Beryl A. 

Howell issued a search warrant for^^^^^m email account. On or about March 14, 2018, 
Chief Judge Beryl A. Howell issued a search warrant for STONE’s iCloud account. Information 
recovered pursuant to those search warrants indicated the following: 

48. On or about May 15, 2016, emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now ...CORSI responded, “I copied Roger Stone 
so he knows your availability to meet Manafort and DT this coming week.” CORSI appears to 
have forwarded the message to STONE atwho replied to CORSI that, 
“May meet Manafort -guarantee nothing.” 

49. On or about May 18, 2016, CORSI emailed STONE 

with the title, “Roger — why don't you look this over before I send I believe that 

CORSI 

BHBHHHBpHJHfland I did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

50. On July 25, 2016, STONE, sent an to 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” 

51. On or about July 31, 2016, STONE, usin^^^^^^^^^^^^^|, emailed 

CORSI with the subject line, “Call me MON.” The body of the email read: should see 

Assange[.]^^^^l should find Bernie [Sjanders brother who called Bill a Rapist - turn him for 
Trump[.]^^^^l should or more proof of Bill getting kicked out.” 
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52. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

^^^^^^^^^^^^^^“Word is friend in embassy plans 2 more dumps. One shortly after I'm 
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug. 
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for 
HRC an artifact of rigged polling. Won't last. I expect presidential campaign to get serious 
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w 
enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. 
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I 
expect that much of next dump focus, setting stage for Foundation debacle.” Investigators 
believe that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” refers to 
Julian ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London Embassy in 
2016. 

53. On or about August 5, 2016, an associate of STONE’s, emailed 

STONE The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.”^^^^^| subsequently stated to investigators that, around the same 
time, STONE told him he had gone to London to meet ASSANGE^^^^^^Jalso stated that 
in 2018, to Id STONE he would be interviewed by the FBI and would have to 

divulge the conversation about meeting ASSANGE. STONE told^^^^^^fhe was joking and 
had not actually met ASSANGE. 

54. On or about August 15, 2016, CORSI emailed STONE at 
■■■■■■ “Give me a call today if you can. Despite MSM drumroll that HRC is 
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already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

55. On or about August 31, 2016, CORSI emailed STONE at 

“Did you get the PODESTA writeup.” STONE replied “yes.” 

56. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

57. On or about September 6, 2016, CORSI emailed STONE at 

“Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

58. On or about September 24, 2016, emailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators,^^^^^^| indicated this conversation 
concerned possible derogatory information he was trying to obtain from Turkey. 

59. On or about October 3, 2016, an associate of STONE emailed STONE at 

and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON and wrote: “You should call Roger. See below. You didn’t get from me.” BANNON 
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wrote back, “I’ve got important stuff to worry about.” The associate responded, “Well clearly he 
knows what Assange has. I’d say that’s important.” 

60. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

61. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

62. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” Stone replied, “Don't think so BUT his lawyer^^^^J is a big 
democrat.” 

63. When BANNON spoke with investigators during a voluntary proffer on February 
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 
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F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

64. According to a publicly available news article, 2 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 
2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling 
Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

to phone records 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

66. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

67. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

68. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

69. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

70. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


2 https://www.washingtonpost.com/Iifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31 d74714-8ce5-11 e6-875e-2c 1 bfe943b66_story.html 
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On or about August 2, 2016, when CORSI emailed STONE on 

wrote, “I expect that much of next dump focus, setting stage for Foundation debacle.” 

71. At approximately 6:27PM, sent STONE an email titled, 

“WikiLeaks - The Podesta Emails,” with a link to the newly-released Podesta emails. 
Approximately ten minutes later, STONE, using^^^^^^^^^^^^J forwarded Hm 
message to CORSI without comment. STONE does not appear to have forwarded the email to 
any other individual. 

G. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 

STONE Is Accused of Advance Knowledge of the Leak 

72. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

73. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

emailed Corsi asking him to “send me your best podesta links.” 

STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?” 

74. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

with a 
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“Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE podesta 
talking points Oct 12 2016.docx.” The “talking points” included the statement that “Podesta is at 
the heart of a Russian-government money laundering operation that benefits financially Podesta 
personally and the Clintons through the Clinton Foundation.” 

75. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

76. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
mmmi “PODESTA ~ Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like ^^^^^^|skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombankf.] The Russians launched a criminal investigation^] [web link] Once^^^^^^l 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombankf.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

77. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at ^^^^^^^^^^^Jwith the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
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name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did^^^^^^^^^^Ja controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Melcombank, a Russian regional bank owned 99.978 percent by with the money 

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

78. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

79. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just landed 
JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important intel to 
share.” 



80. On or about October 17, 2016, CORSI emailed STONE at 

with the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
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It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

81. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

82. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

83. On or about November 8, 2016, the United States presidential election took place. 

84. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 

“Congratulations, Roger. He could not have done it without you.” 

85. On or about November 10, 2016, CORSI messaged STONE at his iCloud 

account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 

London. Have some interesting news for you.” 
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I. Evidence of Google Searches Relating to the Conduct Under Investigation 


92. The search history associated with the account which was 

obtained pursuant to search warrant, shows that STONE searched for terms that appear to be 
related to the DNC hack and the stolen emails, including his nexus thereto, while logged into the 

For example, on or about October 13, 2016, STONE searched for the 
words “Roger Stone john Podesta.” The search history appears to 

have been deleted between January' 18, 2016, and July 23, 2016. 

93. During the course of its investigation, the FBI has also identified a series of 
searches that appear to relate to the personas Guccifer 2.0 and DCLeaks, which predate the 
public unveiling of those two personas. In particular, between May 17, 2016, and June 15, 2016 
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(prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that 
searches were conducted for the terms “dcleaks,” “guccifer,” and “guccifer june,” from IP 
addresses within one of two ranges: 172.56.26.0/24, 107.77.216.0/24. 3 These IP ranges are 
assigned to T-Mobile USA, Inc., and AT&T Mobility LLC, respectively, and, according to 
Google, the searches were all conducted from Florida. On or about June 13, 2018, this Court 
issued a search warrant for information associated with these searches and, in particular, for the 
full search histories associated with the CookielDs that conducted the search. 4 As set forth in the 
affidavit submitted in support of that search warrant, IP logs obtained from Twitter showed that 
STONE used multiple IP addresses within the ranges 172.56.26.0/24 and 107.77.216.0/24 to log 
into his Twitter account @RogerJStoneJr. A Facebook account controlled by STONE also used 
an IP address within the range 172.56.26.0/24 on or about June 13, 2016, to purchase a Facebook 
advertisement. 

J. The Target Accounts 

94. Subscriber records show that, in addition STONE 

maintains at least two additional Google accounts registered in his name: 

(“Target Account was on July 

and uses the recovery email address According to subscriber records, 

Target Account 1 was last accessed on July 5, 2017. Search warrant returns for 

that on or about August 3, 2016, STONE sent an email from 

3 Google does not retain full IP addresses for searches conducted more than one year ago. The 
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a 
range of up to 256 IP addresses. 

4 Google assigns unique CookielDs to searches conducted while a user is not logged into a 
Google account. All searches conducted from the same device and browser during a 24-hour 
window are associated with the same CookielD. 
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to Target Account 1, with no subject, attaching what appears to be an 
advertisement for his book tour, entitled, “Clinton’s War on Women.” 

^^^^^^^^^^^^^^^^^“Target Account 

October 26, 2016, and uses Target Account 1 as the recovery email. Target Account 2 was last 
accessed on or about August 8,2017. 

95. The search of STONE’s Hotmail account indicates that STONE uses the address 

^^^^^^^^^^^^^^“Targct Account For on or 

received an email in his^^^^^ccount from the “Gmail Team” with the subject, 

“Your Gmail address,has been created.” Subscriber records show that 
Target Account 3 was created on June 27, 2016, and is registered in the name of “Swash 
Buckler.” On or about April 16, 2018, this Court issued an order pursuant to 18 U.S.C. 

§ 2703(d) for non-content information associated with Target Account 3. Based on a review of 
the header information obtained from Google pursuant to that Order, it appears that STONE 
frequently used Target Account 3 to communicate with others via the classified advertisement 
website Craigslist.org (“Craigslist”). 

96. This warrant application seeks only search history for the Target Accounts; it 
does not seek the content of email communications to and from the Target Accounts. 5 Google 
maintains records of the Google searches that a user conducts while signed into a particular 
Google email account (provided the user has not disabled the retention of this information). In 
my training and experience, I know that users are often not aware of whether or not they are 

5 The government is also contemporaneously seeking an order pursuant to 18 U.S.C. § 2703(d) 
for non-content information associated with Target Accounts 1 and 2, including header 
information. 
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experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

99. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with a Google account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, an account’s search 
history may indicate who used or controlled the account at a relevant time. Further, information 
maintained by the email Providers can show how and when the account was accessed or used. 
Additionally, information stored in an account’s search history may indicate the geographic 
location of the account user at a particular time ( e.g ., location information integrated into an 
image or video sent via email). Lastly, stored electronic data, including search history 
information, may provide relevant insight into the email account owner’s state of mind as it 
relates to the offense under investigation. For example, information in the email account may 
indicate the owner’s motive and intent to commit a crime (e.g., searches relating to the crime), or 
consciousness of guilt (e.g., deleting search history in an effort to conceal information from law 
enforcement). 

FILTER REVIEW PROCEDURES 

100. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
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other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
The government, however, does not at this time anticipate that any of the items described in 
Attachment A will contain materials requiring review by a designated filter team. 

CONCLUSION 

101. Based on the forgoing, I request that the Court issue the proposed search warrant. 

102. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

103. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 
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Respectfully submitted, 

Andrew Mitchell 
Special Agent 

Federal Bureau of Investigation 



yl& 

Subscribed and sworn to before me on thi sx / day of July, 2018. 

The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to search history information associated with the following accounts 
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain 


View, California: 
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ATTACHMENT B 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. All search history information associated with each account. 

II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present, 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone,^^^^^^^^^^| Julian Assange, or 
any individual associated with the Trump Campaign; 

e. Evidence indicating the account owner’s state of mind as it relates to the crimes under 
investigation; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Information, documentation and records relating to who created, used, or communicated 
with the account or identifier concerning the messages identified above, including records 
about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All evidence of wiping software, encryption or other methods to avoid detection by law 
enforcement; 

g. Evidence of passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 

h. Evidence of credit card and other financial information, including but not limited to, bills 
and payment records evidencing ownership of the subject account; 


I. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of ) 

(Briefly describe the. properly to be searched ) 

or identify the person by name and address) } 

INFORMATION ASSOCIATED WITH THREE ) 

ACCOUNTS STORED AT PREMISES ) 

CONTROLLED BY FACEBOOK ) 


Case: 1:18-sc-02570 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/2/2018 
Description; Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location}'. 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal ( identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 1 5, 2018 _ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
properly was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howell, Chief U.S. District Judge 

(United States Magistrate Judge) 

l 5 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

CJ for_days (not to exceed 30) O until, the facts justifying, the later specific date of___. 


Date and time issued: 




Hon, Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state; 


Washington, DC 
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AO 93 (Rev, 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjuiy that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer‘s signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Facebook accounts, 
which are stored at premises owned, maintained, controlled, or operated by Facebook, Inc. 
(“Facebook”), a company headquartered at 1 Hacker Way, Menlo Park, California 94025: 



-1- 
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ATTACHMENT B 

I, Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook Inc. (“Facebook”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C, § 2703(f), Facebook is required to disclose the 
following information to the government for each user ID listed in Attachment A: 

(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 

(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 
tags; and information about the user’s access and use of Facebook applications; 
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(e) All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

(0 All records relating to machine cookies; 

(g) All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

(h) All IP logs, including all records of the IP addresses that logged into the account; 

(i) All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

(j) All information about the Facebook pages that the account is or was a “fan” of; 

(k) All past and present lists of friends created by the account; 

(l) All records of Facebook searches performed by the account; 

(m) All information about the user’s access and use of Facebook Marketplace; 

(n) The types of service utilized by the user; 

(o) The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

(p) Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

(q) All past and present Admins for the group; 

(r) The “Creator” of the group; 
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(s) All privacy settings and other account settings, including privacy settings for 
individual Face bo ok posts and activities, and all records showing which Facebook 
users have been blocked by the account: 

(t) All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
sendees and records of actions taken; 

(u) All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected and queried. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit w'ire fraud), 
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present, 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 
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b. Ail records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Roger Stone, Jerome 

Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the 
Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

f. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

g. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

h. The source of ail funds used to purchase advertisements or make other expenditures 
or disbursements in these accounts; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 
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j. The identity of any non-U,S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

k. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 
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United States District Court 


for the 

District of Columbia 


In the Matter of the Search of 


PILED 

AUG - 2 2018 


(Briefly describe the property to be searched 
or identify llie person by name and address) 

INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY FACEBOOK 


Case: 1:18-sc-02570 
Assigned To : Howell, Beryl A 
Assign. Date : 8/2/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the Northern District of California , there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

9)f property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section Offense Description 

18 U.S.C. §§ 2, 3, 4, 371 Aiding & Abetting, Accessory after the Fact, Misprision of a Felony, Conspiracy 

18 U.S.C. §§ 1030, 1343, 1349 Unauthorized Access of Protected Computer, Wire Fraud, Wire Fraud Conspiracy 
52 U.S.C. § 30121 Foreign Contribution Ban 

The application is based on these facts: 

See attached Affidavit. 


(jf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: ) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
[i<yie R. Freeny (ASC) 




Applicant’s signature 


Andrew Mitchell, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 


Date: /?- 

Judge s signature 

City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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FILED 

IN THE UNITED STATES DISTRICT COURT AUG - 2 2018 

FOR THE DISTRICT OF COLUMBIA Clerk, U S. District & Bankruptcy 

, for the District of Co/umbfa 

IN THE MATTER OF THE SEARCH OF 

INFORMATION ASSOCIATED WITH Case: 1 :18-sc-02570 

THREE FACEBOOK ACCOUNTS Assigned To : Howell Beryl A 

STORED AT PREMISES CONTROLLED Assign. Date : 8/2/2018 
BY FACEBOOK, INC._ Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the Facebook accounts associated with the following user IDs: 



which are stored at premises owned, maintained, controlled or operated by Facebook Inc., a social 
networking company headquartered in Menlo Park, California (“Facebook”). The information to 
be disclosed by Facebook and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. Asa Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 (wire fraud), and 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. 

§ 30121(a)(1)(C) (foreign expenditure ban). There also is probable cause to search the 
information described in Attachment A for evidence, contraband, fruits, and/or instrumentalities 
of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
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relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 

ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 


Election 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
(Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5,2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard 
to the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with ASSANGE. I believe the next tranche of his documents 
pertain to the Clinton Foundation but there’s no telling what the October surprise may be.” A 
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he 
had a close friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted stating: “Trust me, 
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it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview 
that same day, STONE reiterated that because of the work of a ‘“mutual acquaintance’ of both 
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in 
the form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think 
Julian Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. 

I 

I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2,2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, John Podesta - referring back to STONE’s 
August 21, 2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable 
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the 
release of his emails] and the Trump campaign had advanced warning about what Assange was 
going to do. I think there’s at least a reasonable belief that [Assange] may have passed this 
information on to [STONE].” Commenting to the NBC News, STONE indicated that he had 
never met or spoken with Assange, saying that “we have a mutual friend who’s traveled to 
London several times, and everything I know is through that channel of communications. I’m not 
implying I have any influence with him or that I have advanced knowledge of the specifics of 
what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, 
the Clinton aides, thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctV me the more people think you're lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate 
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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from the government and the courts ruled it was legal to do so and refused to issue an order 
restraining the paper from publishing additional articles. If the US government moves on you I 
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I 
don't know of any crime you need to be pardoned for - best regards. R.” That same day, 
@JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the DoJ side 
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us 
into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE,Others Regarding 

Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

issued a search warrant for STONE’ s^^^J address, On October 

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE’s^^^J 
addresses,On or about December 19, 2017, Chief Judge Beryl A. 

Howell issued a search warrant for^^^^^^^Jemail account. On or about March 14, 2018, 
Chief Judge Beryl A. Howell issued a search warrant for STONE’s iCloud account. Information 
recovered pursuant to those search warrants indicated the following: 

42. On or about May 15,2016, emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now ....” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
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appears to have forwarded the message to STONE at who replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18, 2016, CORSI emailed STONE at 

with the title, “Roger — why don't you look this over before I send believe that 

CORSI wrote, 

d I did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, using sent an email 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, using^^^^^^^^^^^^^^ emailed 

CORSI with the subject line, “Call me MON.” The body of the email read: should see 

Assange[.] should find Bemie [Sjanders brother who called Bill a Rapist - turn him for 

Trump[.] ^^^^Jshould find or more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

“Word is friend in embassy plans 2 more dumps. One shortly after I'm 
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug. 
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for 
HRC an artifact of rigged polling. Won't last. I expect presidential campaign to get serious 
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w 
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enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. 
Would not hurt to start suggesting HRC old, memory bad, has stroke — neither he nor she well. I 
expect that much of next dump focus, setting stage for Foundation debacle.” Investigators 
believe that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” refers to 
Julian ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London Embassy in 
2016. 

47. On or about August 5, 2016,^^^^^^^^^ an associate of STONE’s, emailed 

STONE The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” subsequently stated to investigators that, around the 

same time, STONE told him he had gone to London to meet ASSANGE.^^^^^J also stated 
that in 2018,^^^^^^|told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told^^^^^^^re was joking and 
had not actually met ASSANGE. 

48. On or about August 15,2016, CORSI emailed STONE at 

“Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

49. On or about August 31, 2016, CORSI emailed STONE at 

“Did you get the PODESTA writeup.” STONE replied “yes.” 

50. On or about August 31,2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
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S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

51. On or about September 6, 2016, CORSI emailed STONE at 

“Roger[,j Is NY Post going to use the Pedesta [sic] stuff?” 

52. On or about September 24, 2016, ^^^^^^^|emailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” wrote back, “Awaiting secret file. Explosive... Hope you are well. 

Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, indicated this 

conversation concerned possible derogatory information he was trying to obtain from Turkey. 

53. On or about October 3, 2016, an associate of STONE emailed STONE at 
mUmj^miHand asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON and wrote: “You should call Roger. See below. You didn’t get from me.” BANNON 
wrote back, “I’ve got important stuff to worry about.” The associate responded, “Well clearly he 
knows what Assange has. I’d say that’s important.” 

54. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
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information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

55. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. t otal BS hype.” 

56. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” Stone replied, “Don't think so BUT his lawyer a big 

democrat.” 

57. When BANNON spoke with investigators during a voluntary proffer on February 
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

58. According to a publicly available news article, 2 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 


2 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-lle6-875e-2clbfe943b66_story.html 
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from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

According to phone records 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

60. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

61. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

62. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

63. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, when CORSI emailed STONE he 

wrote, “I expect that much of next dump focus, setting stage for Foundation debacle.” 

65. At approximately 6:27PM.^^^^^^^^J sent STONE an email titled, 
“WikiLeaks - The Podesta Emails,” with a link to the newly-released Podesta emails. 
Approximately ten minutes later, STONE, using^^^^^^^^^^^^Q, forwarded^^^m 
message to CORSI without comment. STONE does not appear to have forwarded the email to 
any other individual. 
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G. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 

STONE Is Accused of Advance Knowledge of the Leak 

66. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

67. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using^^^^^^^^^^^^J emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?” 

68. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

with a 

“Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE podesta 
talking points Oct 12 2016.docx.” The “talking points” included the statement that “Podesta is at 
the heart of a Russian-govemment money laundering operation that benefits financially Podesta 
personally and the Clintons through the Clinton Foundation.” 

69. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 
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70. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like^^^^^^^kimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email atwith the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by^^^^^H with the money 
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transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

72. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

73. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

74. On or about October 17, 2016, CORSI emailed STONE at 

with the 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

75. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 
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76. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

77. On or about November 8, 2016, the United States presidential election took place. 

78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

79. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. ^^^^^^^^Slalcments Regarding STONE’s Use of Facebook 

86. On or about Friday, May 18, 2016, ^^^^^^^^Jwas voluntarily interviewed 
by investigators from the Special Counsel’s Office, ^^^^^Jtold investigators that he became 
STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’s 
right-hand man. 

87. According STONE utilized the services of several individuals to 

post social media content to Facebook and Twitter, and that he ^^^^^^Jand STONE both 
instructed these individuals about what to post, ^^^^^^^tated that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 
and that bloggers working for STONE would try to build what looked like real Facebook 
accounts. 3 According to^^^^^^|one of the individuals who did work for STONE on 
Facebook in 2016 was Everett WILKINSON, a social media marketer and IT expert. 

88. further stated that STONE wanted to push out WikiLeaks content 
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 
was pushed out through STONE’s Facebook and Twitter accounts. 


3 Facebook requires that all users of Facebook accounts use their actual name while registering 
and operating their accounts. The terms of service explicitly require that “Facebook users 
provide their real names and information .... You will not provide any false personal 
information on Facebook, or create an account for anyone other than yourself without 
permission.” 
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J. The Target Accounts 

89. According to subscriber records obtained from Facebook, Target Account 1, 

with Facebook user is registered with the vanity name “rogerstone” and 

the email address Target Account associated with^^^^^^^^ 

Based on search warrant returns for STONE’s ^^^^Jaccount 
between on or about October 31, 2016 and November 3, 2016, 
received receipts from Facebook for the purchase of a number of 
advertisements associated with the Target Account, including advertisements with the following 
excerpted titles (as set forth in the receipts): 

• “BREAKING: New #Wikileaks emails prove that Team...” 

• “Roger Stone talked about WikiLeaks, Donald Trump,...” 

90. Additionally, on or about March 31, 2017, STONE received a Facebook receipt at 
his Hotmail account for advertisements associated with Target Account 1, with the following 
excerpted titles (as set forth in the receipt): 

• “Stone Rebuts Charge of Russian Collusion” 

• “I am not in touch with any Russians, don’t have...,” 

• “The charge that I am working for Russian...,” 

• “In fullest statement yet on DNC hacking...” 

• “ROGER STONE - NO consensus that Guccifer 2.0 is a...” 

91. Target Account 2, with Facebook user is registered 

with the vanity name “rogerstone,” using the email account^^^^^^^^^^^^^ On or 
about August 13, 2017, STONE received a receipt from Facebook for several advertisements 
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associated with Target Account 2, including an advertisement with the excerpted title, “I am not 
in touch with any Russians...” 

92. Target Account 3 has the Facebook user was created 

on or about October 27, 2015. The account is registered in the name using 

the email address and the verified telephone number 

According to a public records database, the telephone number is linked to 

Search warrant returns for STONE’s^^^^Jaccount contain a notification from 
Google indicating that^^^^^^^^^^^^^^fis listed as the recovery email for 
£|search warrant returns for STONE’s^^^^|account also 
contain a number of emails from Facebook relating to Target 

Account 3, which may have been auto-forwarded to STONE’s Hotmail account. These emails 
include a notification of a password change to Target Account 3 and at least one receipt for a 
Facebook advertisement associated with Target Account 3, sent on or about June 30, 2016. At 
one of these emails was then forwarded to account 

93. As explained further below, in my training and experience, I know that, in 
addition to posting content and purchasing advertisements, Facebook accounts can be used to 
communicate privately and directly with other users through Facebook’s messaging function. 

This function is similar to the direct messaging function of Twitter, which STONE used to 
communicate with WikiLeaks and ASSANGE in 2016 and 2017. 

BACKGROUND CONCERNING FACEBOOK 

94. Facebook owns and operates a free-access social networking website of the same 
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish 

4 ^^^^^Htold investigators that he would sometimes send emails from STONE’s account. 
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accounts with Facebook, and users can then use their accounts to share written news, photographs, 
videos, and other information with other Facebook users, and sometimes with the general public. 

95. Facebook asks users to provide basic contact and personal identifying information 
to Facebook, either during the registration process or thereafter. This information may include the 
user’s full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook 
security questions and answers (for password retrieval), physical address (including city, state, and 
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook 
also assigns a user identification number to each account. 

96. Facebook users may join one or more groups or networks to connect and interact 
with other users who are members of the same group or network. Facebook assigns a group 
identification number to each group. A Facebook user can also connect directly with individual 
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request” 
accepts the request, then the two users will become “Friends” for purposes of Facebook and can 
exchange communications or view information about each other. Each Facebook user’s account 
includes a list of that user’s “Friends” and a “News Feed,” which highlights information about the 
user’s “Friends,” such as profile changes, upcoming events, and birthdays. 

97. Facebook users can select different levels of privacy for the communications and 
information associated with their Facebook accounts. By adjusting these privacy settings, a 
Facebook user can make information available only to himself or herself, to particular Facebook 
users, or to anyone with access to the Internet, including people who are not Facebook users. A 
Facebook user can also create “lists” of Facebook friends to facilitate the application of these 
privacy settings. Facebook accounts also include other account settings that users can adjust to 
control, for example, the types of notifications they receive from Facebook. 
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98. Facebook users can create profiles that include photographs, lists of personal 
interests, and other information. Facebook users can also post “status” updates about their 
whereabouts and actions, as well as links to videos, photographs, articles, and other items available 
elsewhere on the Internet. Facebook users can also post information about upcoming “events,” 
such as social occasions, by listing the event’s time, location, host, and guest list. In addition, 
Facebook users can “check in” to particular locations or add their geographic locations to their 
Facebook posts, thereby revealing their geographic locations at particular dates and times. A 
particular user’s profile page also includes a “Wall,” which is a space where the user and his or 
her “Friends” can post messages, attachments, and links that will typically be visible to anyone 
who can view the user’s profile. 

99. Facebook allows users to upload photos and videos, which may include any 
metadata such as location that the user transmitted when s/he uploaded the photo or video. It also 
provides users the ability to “tag” (i.e., label) other Facebook users in a photo or video. When a 
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the 
photo or video. For Facebook’s purposes, the photos and videos associated with a user’s account 
will include all photos and videos uploaded by that user that have not been deleted, as well as all 
photos and videos uploaded by any user that have that user tagged in them. 

100. Facebook users can exchange private messages on Facebook with other users. 
These messages, which are similar to e-mail messages, are sent to the recipient’s “Inbox” on 
Facebook, which also stores copies of messages sent by the recipient, as well as other information. 
Facebook users can also post comments on the Facebook profiles of other users or on their own 
profiles; such comments are typically associated with a specific posting or item on the profile. In 
addition, Facebook has a Chat feature that allows users to send and receive instant messages 


-26- 



Case l:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 36 of 47 


through Facebook. These chat communications are stored in the chat history for the account. 
Facebook also has a Video Calling feature, and although Facebook does not record the calls 
themselves, it does keep records of the date of each call. 

101. If a Facebook user does not want to interact with another user on Facebook, the 
first user can “block” the second user from seeing his or her account. 

102. Facebook has a “like” feature that allows users to give positive feedback or connect 
to particular pages. Facebook users can “like” Facebook posts or updates, as well as webpages or 
content on third-party (z. e ., non-Facebook) websites. Facebook users can also become “fans” of 
particular Facebook pages. 

103. Facebook has a search function that enables its users to search Facebook for 
keywords, usernames, or pages, among other things. 

104. Each Facebook account has an activity log, which is a list of the user’s posts and 
other Facebook activities from the inception of the account to the present. The activity log includes 
stories and photos that the user has been tagged in, as well as connections made through the 
account, such as “liking” a Facebook page or adding someone as a friend. The activity log is 
visible to the user but cannot be viewed by people who visit the user’s Facebook page. 

105. Facebook Notes is a blogging feature available to Facebook users, and it enables 
users to write and post notes or personal web logs (“blogs”), or to import their blogs from other 
services, such as Xanga, LiveJoumal, and Blogger. 

106. The Facebook Gifts feature allows users to send virtual “gifts” to their friends that 
appear as icons on the recipient’s profile page. Gifts cost money to purchase, and a personalized 
message can be attached to each gift. Facebook users can also send each other “pokes,” which are 
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free and simply result in a notification to the recipient that he or she has been “poked” by the 
sender. 

107. Facebook also has a Marketplace feature, which allows users to post free classified 
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace. 

108. In addition to the applications described above, Facebook also provides its users 
with access to thousands of other applications (“apps”) on the Facebook platform. When a 
Facebook user accesses or uses one of these applications, an update about that the user’s access or 
use of that application may appear on the user’s profile page. 

109. Some Facebook pages are affiliated with groups of users, rather than one individual 
user. Membership in the group is monitored and regulated by the administrator or head of the 
group, who can invite new members and reject or accept requests by users to enter. Facebook can 
identify all users who are currently registered to a particular group and can identify the 
administrator and/or creator of the group. Facebook uses the term “Group Contact Info” to 
describe the contact information for the group’s creator and/or administrator, as well as a PDF of 
the current status of the group profile page. 

110. Facebook uses the term “Neoprint” to describe an expanded view of a given user 
profile. The “Neoprint” for a given user can include the following information from the user’s 
profile: profile contact information; News Feed information; status updates; links to videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends’ 
Facebook user identification numbers; groups and networks of which the user is a member, 
including the groups’ Facebook group identification numbers; future and past event postings; 
rejected “Friend” requests; comments; gifts; pokes; tags; and information about the user’s access 
and use of Facebook applications. 
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111. Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP address. 
These logs may contain information about the actions taken by the user ID or IP address on 
Facebook, including information about the type of action, the date and time of the action, and the 
user ID and IP address associated with the action. For example, if a user views a Facebook profile, 
that user’s IP log would reflect the fact that the user viewed the profile, and would show when and 
from what IP address the user did so. 

112. Social networking providers like Facebook typically retain additional information 
about their users’ accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the service 
(including any credit card or bank account number). In some cases, Facebook users may 

i 

communicate directly with Facebook about issues relating to their accounts, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 
Facebook typically retain records about such communications, including records of contacts 
between the user and the provider’s support sendees, as well as records of any actions taken by 
the provider or user as a result of the communications. 

113. As explained herein, information stored in connection with a Facebook account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Facebook user’s “Neoprint,” IP log, stored electronic communications, and other data retained by 
Facebook, can indicate who has used or controlled the Facebook account. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a search warrant 
at a residence. For example, profile contact information, private messaging logs, status updates, 
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and tagged photos (and the data associated with the foregoing, such as date and time) may be 
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook 
account activity can show how and when the account was accessed or used. For example, as 
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their 
accounts along with the time and date. By determining the physical location associated with the 
logged IP addresses, investigators can understand the chronological and geographic context of the 
account access and use relating to the crime under investigation. Such information allows 
investigators to understand the geographic and chronological context of Facebook access, use, and 
events relating to the crime under investigation. Additionally, Facebook builds geo-location into 
some of its services. Geo-location allows, for example, users to “tag” their location in posts and 
Facebook “friends” to locate each other. This geographic and timeline information may tend to 
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may 
provide relevant insight into the Facebook account owner’s state of mind as it relates to the offense 
under investigation. For example, information on the Facebook account may indicate the owner’s 
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from 
law enforcement). 

114. Therefore, the computers of Facebook are likely to contain all the material 
described above, including stored electronic communications and information concerning 
subscribers and their use of Facebook, such as account access information, transaction information, 
and other account information. 

FILTER REVIEW PROCEDURES 
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115. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

116. Based on the forgoing, I request that the Court issue the proposed search warrant. 

117. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

118. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 
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Subscribed and sworn to before me on this 



Andrew Mitchell 
Special Agent 

Federal Bureau of Investigation 


S' day ol August, 2018. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Facebook accounts, 
which are stored at premises owned, maintained, controlled, or operated by Facebook, Inc. 
(“Facebook”), a company headquartered at 1 Hacker Way, Menlo Park, California 94025: 
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ATTACHMENT B 

I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook Inc. (“Facebook”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the 
following information to the government for each user ID listed in Attachment A: 

(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 

(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 
tags; and information about the user’s access and use of Facebook applications; 
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(e) All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

(f) All records relating to machine cookies; 

(g) All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

(h) All IP logs, including all records of the IP addresses that logged into the account; 

(i) All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

(j) All information about the Facebook pages that the account is or was a “fan” of; 

(k) All past and present lists of friends created by the account; 

(l) All records of Facebook searches performed by the account; 

(m) All information about the user’s access and use of Facebook Marketplace; 

(n) The types of service utilized by the user; 

(o) The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

(p) Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

(q) All past and present Admins for the group; 

(r) The “Creator” of the group; 
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(s) All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

(t) All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

(u) All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected and queried. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present, 
including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Roger Stone, Jerome 

Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the 
Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

f. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

g. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

h. The source of all funds used to purchase advertisements or make other expenditures 
or disbursements in these accounts; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 
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j. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

k. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE 
ACCOUNTS STORED AT PREMISES CONTROLLED 
BY MICROSOFT, GOOGLE, AND APPLE 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of _ California 

(identify the person or describe the property to be searched and give its location)'. 


) Case: 1:18-sc-02581 

) Assigned To : Howell, Beryl A. 

) Assign. Date : 8/3/2018 

) Description: Search & Seizure Warrant 


See Attachment E 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 


See Attachment F 


YOU ARE COMMANDED to execute this warrant on or before Augus t 15, 2018 _ (not to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for days (not to exceed 30) □ until, the facts justifying, the later specific date of _ ___. 


Date and time issued: 


9/f/^/r 2 L S T/A 



City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer‘s signature 


Printed name and title 
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ATTACHMENT E 


Property to be Searched 

This warrant applies to information associated with the following Apple DSID: 



created or maintained between March 14,2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 
California 95014. 
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ATACHMENT F 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome C orsi,^^^^^^^^^B Julian Assange, 

Rand > Credico, or any individual 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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AO 106 (Rev, 04/10) Application for a Search Warrant 


United States District Court ; l l. '$ 1 1 


for the 


AUG - 3 2016 


District of Columbia 


-“"T’ msirici & bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of j 

(Briefly describe the property to be searched \ 

or identify the person by name and address) \ 

INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY MICROSOFT, , 
GOOGLE, AND APPLE ) 


Case: 1:18-sc-02581 
Assigned To : Howell, Beryl A 
Assign. Date : 8/3/2018 
Description. Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment E 

located in the _ Northern _District of_ California , there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment F 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

S ( contraband, fruits of crime, or other items illegally possessed; 

l?f property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 


□ 



Delayed notice of_days (give exact ending date if more than 30 days: 

under 18 U.S.C. § 3103a, the basis of which is set forth on 


) is requested 


Reviewed by AUSA/SAUSA: 
Aaron Zelinsky (ASC) 


Applicant’s signature 

Andrew Mitchell, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 

Date: jgZX _ 

Judge’s signature 

City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


AUG - 3 2018 

Wert, 0.8. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 

INFORMATION ASSOCIATED WITH Case: 1:18-sc-02581 

THREE ACCOUNTS STORED AT Assigned To : Howell, Beryl A. 

PREMISES CONTROLLED BY Assign. Date : 8/3/2018 

MICROSOFT, GOOGLE, AND APPLE Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the following: 

a. The email account ^^^^^^^^^^^^^^hereafter “Target Account 1), that 
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

b. The email account ^^^^^^^^^^^^^hereafter “Target Account 2”), that 
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments C and D. 

c. The iCloud account associated with the Apple email account 

^^^^^^^^^^^^Hfhereaftcr “Target Account 3”), that is stored at premises owned, 
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maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. Asa Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for Roger STONE’s Hotmail address,(Target 
Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s 
Gmail address,(Target Account 2). On or about March 14, 2018, Chief 
Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 


JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 

SUMMARY 

7. This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’s ^^^^^account; Target Account 2, which is 
STONE’s^^^^ccount; and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 
scheduled to testify before Congress about interactions with STONE during the 2016 presidential 
campaign or were scheduled to meet with the Special Counsel’s Office 

After STONE learned that one witness, Randy 

CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly 
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urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 
through multiple text messages. In June 2018, STONE instructed his private investigator to 
provide him with a full background investigation on another witness,who had 

9. In September 2017, STONE released a statement he said he provided to Congress 
in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 
to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emailsf.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to have^^^^^^^^^^^^^^contact ASSANGE. On or about August 2, 2016, CORSI 
responded to STONE that the “[w]ord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging.... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 
United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
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Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

c. Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 


tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 

i. Roger STONE 

10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 

11. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 

13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (“USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

b. The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

c. With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 
networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1, 2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

17. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later posted on DCLeaks. 
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18. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
States v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.). 1 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 


1 A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 
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22. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

27. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a ‘“mutual acquaintance’ 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. Pm not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
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from an email address associated with WikiLeaks, denied that there was any baclcchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

c. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctY' me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

e. In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 
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F. STONE’s Communications with STONE,and Others Regarding 
Forthcoming Leaks 

37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search 
STONE’s^^^^|address,(Target Account on 
October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s^^^J address, 

(Target Account 2); and on or about March 14, 2018, Chief Judge 
Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 
on or about December 19, 2017, Chief Judge Howell issued a search warrant 
email account. Information recovered pursuant to those search warrants includes the following: 

a. On or about May 15, 2016,^^^^^^| emailed CORSI: “Here is my 
flight schedule. Need to get something confirmed now ....” CORSI responded, “I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI 
that, “May meet Manafort -guarantee nothing.” 

b. On or about May 1 8 , 2016, CORSI emailed STONE at Target Account 1 

with the title, “Roger — why don’t you look this over before I send I believe that 

CORSI 

H^H|H^HH^»nd I did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

c. On July 25, 2016, STONE, using Target Account 1, sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d. On or about July 31, 2016, STONE, using Target Account 1, emailed 

CORSI with the subject line, “Call me MON.” The body of the email read should see 

Assangef.] should find Bemie [Sjanders brother who called Bill a Rapist - turn him for 

Trump[.] should or more proof of Bill getting kicked out.” 

e. As noted above, on or about August 2, 2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke — neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 
[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 
2016. 

f. On or about August 5, 2016, an associate of STONE’s, 

emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded, “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” subsequently stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet ASSANGE.^^^^^^^ also stated 
that in 201told STONE he would be interviewed by the FBI. and would have to 
divulge the conversation about meeting ASSANGE. STONE tol(^^^^^^| he was joking and 
had not actually met ASSANGE. 2 

g. On or about August 15, 2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

j. On or about September 6, 2016, CORSI emailed STONE at Target 
Account 1: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

k. On or about September 24, 201emailed CORSI, “I will 
have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 
him about it again today.”^^^^^^| wrote back, “Awaiting secret file. Explosive... Hope you 
are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigators, indicated this 

conversation concerned possible derogatory information he was trying to obtain from Turkey. 

l. On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote back, 
“It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 
Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 
BS hype.” 
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o. That same day, BANNON emailed STONE at Target Account 2, “What 

was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ Clintons???” STONE replied, “Don’t think so BUT his lawyer is a 

big democrat.” 

p. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 

38. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 

According to phone records at 

11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyIe/style/the-caIler-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/31d74714-8ce5-l le6-875e-2clbfe943b66_story.html 
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40. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

41. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately 6:27PM,^^^^^^^^| an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded message to CORSI without comment. STONE does not appear 

to have forwarded the email to any other individual. 

H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

46. On or about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I 
understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12 , 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-government money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Moolc.” CORSI wrote back to 
STONE, “I’ll give you one more — NOBODY YET PIAS THIS[:] It looks to me like 
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skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once^^^^^^ 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombankf.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 

STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money a controversial Russian billionaire investor with 

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent by with the money transferred via Deutsche 

Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52. On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE.. .URGENT..CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“Pis call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

57. On or about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 


59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 
“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 
Have some interesting news for you.” 
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J. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


61. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

63. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE’s 
“Back channel” 
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64. On November 19, 2017, Randy CREDICO (who, as described further below, 

STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, ‘“Stonewall it. Plead the 
fifth. Anything to save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

7 

65. On or about November 21, 2017, CREDICO messaged STONE on Target 
Account 3, “I was told that the house committee lawyer told my lawyer that 1 will be getting a 
subpoenaf.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your 5th Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 
back, “Not the way I remember it - oh well I guess Schiff will try to get one of us indicted for 
perjuryf.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what a headachef.] 4 You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth ... 

You want me to cover you for perjury now[.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 
and you can get away with asserting for 5th Amendment rights if u don’t want talk about AND if 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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you turned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjuryf.] But I’m sure that wasn’t sworn testimony so you’re probably 
clear[.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot. .. you should go back ... and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testifyf.]” 

71. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email I sent to WikiLeaks website email address asking you would do my 
show[.] That was my initial contact.” 
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74. On or about January 8, 201 8 , CREDICO messaged STONE on Target Account 3 
stating: “Embassy logs . . . + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

75. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Intel 
committee . .. But you’ll get off because you’re friends with Trump so don’t worry. I have all 
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September 
of 2016 to prove it[.]” 

76. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 

the Investigation 

78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 
individuals related to the investigation. 

79. For example, STONE and^^^^^J communicated twice on May 28 and May 

29, 2018 using Target Account 1. a former associate of STONE’s, was 

interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 

and STONE communicated multiple times on May 5, 2018, and STONE 
communicated with^^^^^J using Target Account 1 on June 1, 2018 and June 6, 2018.^ 
a private investigator who had previously worked with STONE and who was hired 
by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 
July 12, 2018. 

80. STONE has also used Target Account 2 to communicate with individuals 
associated with this investigation. 

a. For example, between May 23, 2018 and the present, STONE and CORS1 
exchanged at least five messages using Target Account 2. In the same time period, STONE 
exchanged at least 75 emails with CREDICO using Target Account 2. 
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81. STONE has also used a phone number associated with Target Account 3 to 

communicate with a private investigator hired by STONE.^^^^^^^Jwas 

interviewed by investigators on June 7, 2018, and subsequently informed investigators that in 
June 2018, STONE instructed him to conduct a full background investigation 
^^^Jwho had been employed by STONE during the Campaign as an information technology 

HHHHHHHHhH also told investigators that in June 2018, STONE instructed him to find 

an address for CREDICO that could be used to serve CREDICO with legal process. 
^^^^^^Jtold investigators that his primary form of communication with STONE is by text 
message on Target Account 3. 

BACKGROUND CONCERNING EMAIL 

82. In my training and experience, I have learned the Providers provide a variety of 
on-line services, including electronic mail (“email”) to the public. The Providers allow 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
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(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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infonnation maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time {e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime {e.g., 
communications relating to the crime), or consciousness of guilt {e.g., deleting communications 
in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 

INFORMATION REGARDING APPLE ID AND iCLOUD 7 


7 The information in this section is based on infonnation published by Apple on its website, including, but 

not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at hUD://imaizes.apple.com/privacv/docs/le»al-process-uuidelmes-us.pdf; ‘‘Create and start using an Apple ID,” 
available at htt ps://support,apple,com/en-us/HT2Q3993 ; “iCloud,” available at htlp://www.apple.com/icloud/ ; “What 
does iCloud back up?,” available at https://suppoi1.appie.com/kb/PH 12519; “iOS Security,” available at 
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88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 
the Mac OS operating system. 

89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

c. iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


https://www.aDplc.coni/business/docs/iOS Security Guide.pdf . and “iCloud: How Can I Use iCloud?,” available at 
https://support.apple.com/kb/PH26502 . 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f. Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

91. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgof ’ pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 
device. 
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95. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 
nonetheless be decrypted by Apple. 

96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 


42 



Case l:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 50 of 189 


97. 1 anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted. 



Federal Bureau of Investigation 
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Subscribed and sworn to before me on this __day of August, 2018. 

-^ ■- 1 , 

The Honorable Beryl A. Howell 

Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the email address: 



created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 
at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible irmterial^hayjelatyn any way to 
communicationsoijneetingsinvolvingJeromeCorsi,^^^^^^^^^M Julian Assange, 

Rand}' C-redico, or any individual 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT C 
Property to be Searched 

This warrant applies to information associated with the following Google account: 



created or maintained between October 17, 2017 and the present, that is stored at premises 
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 
1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 
I. Files and Accounts to be produced by Google, Inc. 

To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private 
messages, and comments; 

k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible material^haU^lat^n any way to 


communications or meetings involving Jerome Corsi. 



Julian Assange, 


andy Credico, or any individual 


associate^ 


rump campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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ATTACHMENT E 


Property to be Searched 

This warrant applies to information associated with the following Apple DSID: 



created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 
California 95014. 
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ATACHMENT F 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, tiles, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communicationsormeetingsinvolvingJeromeCorsi,^^^^^^^^^^| Julian Assange, 

Randy Credico, or any individual 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE 
ACCOUNTS STORED AT PREMISES CONTROLLED 
BY MICROSOFT, GOOGLE, AND APPLE 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Western _ District of _W ashington 

(identify the person or describe the property to be searched and give its location f 


) Case: 1:18-SC-02582 
) Assigned To : Howell, Beryl A. 

) Assign. Date : 8/3/2018 
) Description: Search & Seizure Warrant 
) 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _ August 15, 2018 (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_Hon. B eryl A. Howell, Chief U . S. District Judge * 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed30) □ until, the facts justifying, the later specific date of_. 


Date and time issued: 


City and state: 


hi/lcrc* 'c viannhiYP 


Washington, DC 


Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date:__ _____ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the email address: 



created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 
at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I. A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 


46 



Case l:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 68 of 189 


II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materiabUhaU^lat^n any way to 


nications or meetings involving Jerome Corsi. 



lJulian Assange, 


andy Credico, or any individual 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 


for the 

District of Columbia 


AUG - 3 




In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY MICROSOFT, 
GOOGLE, AND APPLE 


Case: 1:18-sc-02582 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/3/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the _ Western _ District of__ Washington _, there is now concealed (identify the 

person or describe the property to be seized)'* 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

fif contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §§ 1505,1512,1513 Obstruction of justice, Witness tampering 

18 U.S.C. §§ 1001,1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_ ) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attache^ sheet. 


Andrew Mitchell, Special Agent, FBI 

Printed name and title 

Sworn to before me and signed in my presence. 

Date: /U // _ 

Judge’s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 



Reviewed by AUSA/SAUSA: 
Aaron Zelinsky (ASC) 


City and state: Wash ington, D.C. 


Printed name and title 
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filed 

aug - 3 m 

Courts * S ' ^ ls * nct & Bankruptcy 

IN THE UNITED STATES DISTRICT COURT °“ r S ° r * 6 D,Strlct of Co ' umbla 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
MICROSOFT, GOOGLE, AND APPLE 


Case: 1:18-sc-02582 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/3/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the following: 

a. The email account^^^^^^^^^^^^^|(hereafter “Target Account 1), that 

stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

b. The-email account ^^^^^^^^^^^^|(hereafter “Target Account 2”), that 
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments C and D. 

c. The iCloud account^^^^^^^^^^^^^^issociated with the Apple email account 
^^^^^^^^^^^^^|(hereafter “Target Account 3”), that is stored at premises owned, 
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maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § ,1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witn'ess tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

issued a search warrant for Roger STONE’s address, ^^^^^^^^^^^^^^^Target 

Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s 

address, (Target Account 2). On or about March 14, 2018, Chief 
Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court). .. that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 

SUMMARY 

7. This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’s ^^^^account; Target Account 2, which is 
STONE’s ^^^Baccount; and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 
scheduled to testify before Congress about interactions with STONE during the 2016 presidential 
campaign or were scheduled to meet with the Special Counsel’s Office and/or appear before the 
Grand Jury investigating such interactions. After STONE learned that one witness, Randy 
CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly 
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urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 
through multiple text messages. In June 2018, STONE instructed his private investigator to 
provide him with a full background investigation on another witness,had 

9. In September 2017, STONE released a statement he said he provided to Congress 
in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather, to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 

to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to have contact ASSANGE. On or about August 2, 2016, CORSI 

responded to STONE that the “[w]ord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging.... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 
United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
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Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

c. Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 
tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 

i. Roger STONE 

10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 

11. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 

13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (“USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

b. The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

c. With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 
networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1, 2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

17. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later posted on DCLeaks. 
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18. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
States v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.). 1 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 


1 A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 


10 



Case l:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 81 of 189 


22. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

27. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. //CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a ‘“mutual acquaintance 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. //WikiLeaks.” 

31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 


12 



Case l:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 83 of 189 


of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta —referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
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from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

c. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctY' me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9,2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

e. In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 
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F. STONE’s Communications with STONE, and Others Regarding 

Forthcoming Leaks 

37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search 

for STONE’s^^^^^ddress,^^^^^^^^^^^|(Target 

October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s ^^^Jddress, 
^^^^^^^^^^^^^|(Target Account 2); and on or about March 14, 2018, Chief Judge 
Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 
on or about December 19, 2017, Chief Judge Howell issued a search warrant for MALLOCH’s 
email account. Information recovered pursuant to those search warrants includes the following: 

a. On or about May 15, 2016, ^^^^^^smailed CORSI: “Here is my 
flight schedule. Need to get something confirmed now ... .” CORSI responded, “I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI 
that, “May meet Manafort -guarantee nothing.” 

b. On or about May 18, 2016, CORSI emailed STONE at Target Account 1 
with the title, “Roger — why don’t you look this over before I send it^^^^^^^I believe that 

CORSI 

B B ^jW H ^^fflHl|Mand I did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

c. On July 25, 2016, STONE, using Target Account 1, sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d. On or about July 31, 2016, STONE, using Target Account 1, emailed 
CORSI with the subject line, “Call me MON.” The body of the email read: ^^^Jshould see 
Assange[.] ^^^^should find Bernie [Sjanders brother who called Bill a Rapist - turn him for 
Trump[.]^^^^| should find^^^^^^^^^or more proof of Bill getting kicked out.” 

e. As noted above, on or about August 2, 2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke - neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 
[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 
2016. 

f. On or about August 5, 2016,^^^^^^^^^^|an associate of STONE’s, 
emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded, “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ^^^^^Msubsequently stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet ASSANGE. stated 

that in 2018,told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told^^^^^^e was joking and 
had not actually met ASSANGE. 2 

g. On or about August 15, 2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $ 180k to invest in Uranium One - was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

j. On or about September 6, 2016, CORSI emailed STONE at Target 
Account 1: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

k. On or about September 24, 2016,^^^^^^^^mailed CORSI, “I will 
have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 
him about it again today.” ^^^^^^Jwrote back, “Awaiting secret file. Explosive... Hope you 
are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigators^^^^^^^|indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

l. On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote back, 
“It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 
Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 
BS hype.” 
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o. That same day, BANNON emailed STONE at Target Account 2, “What 
was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ Clintons???” STONE replied, “Don’t think so BUT his lawyer^^^f is a 
big democrat.” 

p. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released 

38. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 

39. According to phone records at approximately 

11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 Id74714-8ce5-l le6-875e-2clbfe943b66_story.html 
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40. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

41. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately 6:27PM,an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded message to CORSI without comment. STONE does not appear 

to have forwarded the email to any other individual. 

H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

46. On or about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed - have to go see T.” CORSI responded to STONE, “Ok. I 
understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-govemment money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back to 
STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
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skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation^] [web link] Once^^^^^| 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 

STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money did controversial Russian billionaire investor with 

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent by ^^^^^|with the money transferred via Deutsche 
Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52. On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yes[.j I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“Pis call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

57. On or about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 

59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 
“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 
Have some interesting news for you.” 
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J. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 

61 . On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts... . 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.. . . 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assangef] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

63. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. . .. [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE’s 
“Back channel” 
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64. On November 19, 2017, Randy CREDICO (who, as described further below, 

STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, ‘“Stonewall it. Plead the 
fifth. Anything to save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

65. On or about November 21, 2017, CREDICO messaged STONE on Target 
Account 3, “I was told that the house committee lawyer told my lawyer that I will be getting a 
subpoena[.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your 5th Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 
back, “Not the way I remember it — oh well I guess Schiff will try to get one of us indicted for 
perjury[.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebookpost, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . .. Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth ... 
You want me to cover you for peijury now[.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 
and you can get away with asserting for 5th Amendment rights if u don’t want talk about AND if 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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you-turned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjury[.] But I’m sure that wasn’t sworn testimony so you’re probably 
clearf.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot.. . you should go back . . . and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testify[.]” 

71. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email I sent to WikiLeaks website email address asking you would do my 
show[.] That was my initial contact.” 
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74. On or about January 8, 2018, CREDICO messaged STONE on Target Account 3 
stating: “Embassy logs . . . + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

75. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Intel 
committee . . . But you’ll get off because you’re friends with Trump so don’t worry. I have all 
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September 
of 2016 to prove it[.]” 

76. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 

the Investigation 

78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 
individuals related to the investigation. 

79. For example, STONE and ^^^^^^Kommunicated twice on May 28 and May 

29, 2018 using Target Account 1. a former associate of STONE’s, was 

interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 
^|^^^^nd STONE communicated multiple times on May 5, 2018, and STONE 
communicated with^^^^^Jusing Target Account 1 on June 1, 2018 and June 6, 2018. 
M a private investigator who had previously worked with STONE and who was hired 
by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 
July 12, 2018. 

80. STONE has also used Target Account 2 to communicate with individuals 
associated with this investigation. 

a. For example, between May 23, 2018 and the present, STONE and CORS1 
exchanged at least five messages using Target Account 2. In the same time period, STONE 
exchanged at least 75 emails with CREDICO using Target Account 2. 
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b. Also in this same time period, STONE emailed least 

ten times using Target Account 2.^^^^|is a former employee of STONE. On May 9, 
approached That 

on May 1communicated 

STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails 
with^^^^^^^using Target Account 2. In addition, between on or about June 14, 2018 and 
June 17, 2018,^^^^|and STONE exchanged five emails using Target Account 2.^^^^^ 


81. STONE has also used a phone number associated with Target Account 3 to 
communicate with a private investigator hired by STONE, 

interviewed by investigators on June 7, 2018, and subsequently informed investigators that in 
June 2018, STONE instructed him to conduct a full background investigation 
^^^Jvvho had been employed by STONE during the Campaign as an information technology 

specialist.[j^^^ | ||||| || ^| ^^^^^^^^|P j||J||||| | j^||^^P^^P^^||^^^ ||||j| | | j 

also told investigators that in June 2018, STONE instructed him to find 
an address for CREDICO that could be used to serve CREDICO with legal process. 

told investigators that his primary form of communication with STONE is by text 
message on Target Account 3. 

BACKGROUND CONCERNING EMAIL 





82. In my training and experience, I have learned the Providers provide a variety of 
on-line services, including electronic mail (“email”) to the public. The Providers allow 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each "account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in ( i.e ., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 


35 



Case l:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 106 of 189 


(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time ( e.g ., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 

N 

in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 

INFORMATION REGARDING APPLE ID AND iCLOUD 7 


7 The information in this section is based on information published by Apple on its website, including, but 

not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/pnvacv/docs/leeal-proces5-etiideMnes-us.ndf : “Create and start using an Apple ID,” 
available at https://5iinnort.anDlexom/en-us/HT203993: “iCloud,” available at IHi pi// www.apnle.com/idoiid/ ; “What 
does iCloud back up?,” available at htlps://support.apple.com/kb/PH 12519 ; “iOS Security,” available at 
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88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 
the Mac OS operating system. 

89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“Messages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

c. iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


https://www.aDnle.coin/business/docs/iOS Security Guidc.pdf . and “iCloud: How Can I Use iCloud?,” available at 
htt n s: //s 11 d port. a p n I e. com/kb /PH 2 65 02 . 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f. Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

91. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgof ’ pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 
device. 
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95. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, Messages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 
nonetheless be decrypted by Apple. 

96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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97. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 



Andrew Mitchell 
Special Agent 

Federal Bureau of Investigation 
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Subscribed and sworn to before me on this _ day of August, 2018. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the email address: 



created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 
at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 

§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible m aterials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian Assange, 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


landy Credico, or any individual 
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i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT C 
Property to be Searched 

This warrant applies to information associated with the following Google account: 

created or maintained between October 17, 2017 and the present, that is stored at premises 
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 
1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 
I. Files and Accounts to be produced by Google, Inc. 

To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private 
messages, and comments; 

k. Google-i- Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible m aterials that relate in any way to 

communic^on^imieetineynvolvin^terom^Corsi, Julian Assange, 

I Randy Credico, or any individual 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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ATTACHMENT E 


Property to be Searched 

This warrant applies to information associated with the following Apple DSID: 



created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 
California 95014. 


53 





Case l:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 124 of 189 


ATACHMENT F 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible matenahAhaCxlat^n any way to 

communication^mneeting^nvolvin^erom^Corsi, Julian Assange, 

I Randy Credico, or any individual 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

) 

) Case: 1 : 1 8-sc-02583 
) Assigned To : Howell, Beryl A 
) Assign. Date : 8/3/2018 
) Description: Search & Seizure Warrant 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)'. 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE 
ACCOUNTS STORED AT PREMISES CONTROLLED 
BY MICROSOFT, GOOGLE, AND APPLE 


See Attachment C 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment D 


YOU ARE COMMANDED to execute this warrant on or before Augu st 15, 2018 _ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Bery l A. Howell , Chief U.S. Dis trict Judge _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of __. 


Date and time issued: 


City and state: 




Washington, DC 


Judge "s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT C 
Property to be Searched 

This warrant applies to information associated with the following Google account: 

created or maintained between October 17, 2017 and the present, that is stored at premises 
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 
1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 
I. Files and Accounts to be produced by Google, Inc. 

To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 

c. AH internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section LA, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private 
messages, and comments; 

k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate i n any way to 
communications or meetings involving Jerome Corsi,^^^^^^^^^J Julian Assange, 

Randy or any 

associate^witinn^rum^Campaign^^^^^^ 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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AO 106 (Rev. 04/10) Application fora Search Warrant 


United States District Court 


12 


for the 

District of Columbia 


FI 

AUG - 3 m 

Clerk, U.S. l?istfict & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY MICROSOFT, 
GOOGLE, AND APPLE 


) Case: 1:18-sc-02583 

Assigned To : Howell, Beryl A. 

) Assign. Date : 8/3/2018 

) Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment C 

located in the Northern District of California_ , there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment D 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

[?f evidence of a crime; 

[$f contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attachejFsheet. 


) is requested 


Reviewed by AUSA/SAUSA: 


Aaron Zelinsky (ASC) 


Sworn to before me and signed in my presence. 
Date: 






Applicant’s signature 

Andrew Mitchell, Special Agent, FBI 


Printed name and title 



Judge‘s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


AUG - 3 m 

U -S- District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF Case: 1 : 18-SC-02583 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

THREE ACCOUNTS STORED AT Assign. Date : 8/3/2018 

PREMISES CONTROLLED BY Description: Search & Seizure Warrant 

MICROSOFT, GOOGLE, AND APPLE . 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 
1. I make this affidavit in support of an application for a search warrant for 

information associated with the following: 


a. The email account 


(hereafter “Target Account 1), that is 


stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 
and in Attachments A and B. 


b. The email accoun 



(hereafter “Target Account 2”), that is 


stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments C and D. 


c. The iCloud account! 


[associated with the Apple email account 


(hereafter “Target Account 3”), that is stored at premises owned, 
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maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § ,1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witn'ess tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for Roger STONE’^^^^|address, (Target 

Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s 

address,^^^^^^^^^^^^^Target Account 2). On or about March 14, 2018, Chief 
Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 

SUMMARY 

7. This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’s Hotmail account; Target Account 2, which is 
STONE’s Gmail account; and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 
scheduled to testify before Congress about interactions with STONE during the 2016 presidential 
campaign or were scheduled to meet with the Special Counsel’s Office 

After STONE learned that one witness, Randy 

CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly 
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urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 
through multiple text messages. In June 2018, STONE instructed his private investigator to 
provide him with a full background investigation on another witness^^^^^^^^^Jwho had 
done information technology work for STONE during the campaign 

9. In September 2017, STONE released a statement he said he provided to Congress 
in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather, to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 
to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to have^^^^^^^^^^^Jcontact ASSANGE. On or about August 2, 2016, CORSI 
responded to STONE that the “[w]ord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging.... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 
United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
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Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

c. Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 
tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 

i. Roger STONE 

10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 

11. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 

13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (“USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow-—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

b. The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

c. With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 
networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1, 2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

17. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later posted on DCLeaks. 
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18. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
Slates v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.). 1 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 


1 A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 
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22. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

27. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a ‘“mutual acquaintance’ 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. Pm not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 


13 



Case l:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 147 of 189 


from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, 1 guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

c. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctY' me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

e. In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 
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F. STONE’s Communications with and Others Regarding 

Forthcoming Leaks 

37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search 
for STONE’s^^^^| address,(Target on 

October 17, 2017, Chief Judge Howell issued a search warrant for STONE’^^^|address, 

(Target Account 2); and on or about March 14, 2018, Chief Judge 
Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 
on or about December 19, 2017, Chief Judge Howell issued a search warrant 
email account. Information recovered pursuant to those search warrants includes the following: 

a. On or about May 15, 2016^^^^^^^ emailed CORSI: “Here is my 
flight schedule. Need to get something confirmed now ....” CORSI responded,.“I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI 
that, “May meet Manafort -guarantee nothing.” 

b. On or about May 1 8 , 2016, CORSI emailed STONE at Target Account 1 
with the title, “Roger — why don’t you look this over before I send it^^^^^^Jl believe that 

CORSI 

and 1 did manage to see Mr. Trump for a few minutes today as wc were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

c. On July 25, 2016, STONE, using Target Account 1, sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d. On or about July 31, 2016, STONE, using Target Account 1, emailed 

CORSI with the subject line, “Call me MON.” The body of the email read:^^^^^^ should see 
Assangef.]^^^^^ should find Bemie [Sjanders brother who called Bill a Rapist - turn him for 
Trump[.]^^^^J should or more proof of Bill getting kicked out.” 

e. As noted above, on or about August 2, 2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke — neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 
[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 
2016. 

f. On or about August 5, an associate of STONE’s, 

emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded, “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” subsequently stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet also stated 

that in 201 told STONE he would be interviewed by the FBI and would have to 

divulge the conversation about meeting ASSANGE. STONE he was joking and 

had not actually met ASSANGE. 2 

g. On or about August 15,2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

j. On or about September 6, 2016, CORSI emailed STONE at Target 
Account 1: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

k. On or about September 24, 2016,^^^^^^^ emailed CORSI, “I will 
have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 
him about it again today.”wrote back, “Awaiting secret file. Explosive... Hope you 
are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigate indicated this 

conversation concerned possible derogatory information he was trying to obtain from Turkey. 

l. On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote back, 
“It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 
Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 
BS hype.” 
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o. That same day, BANNON emailed STONE at Target Account 2, “What 
was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ Clintons???” STONE replied, “Don’t think so BLIT his lawye^^^^^ is a 
big democrat.” 

p. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 

38. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 

phone record^^^^^^^^^^^^^^^^^^^ at 
11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 ld74714-8ce5-lle6-875e-2clbfe943b66_story.html 
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40. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

41. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately 6:27PM,an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded^^^^Jmessage to CORSI without comment. STONE does not appear 
to have forwarded the email to any other individual. 

H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

46. On or about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I 
understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25 PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-govemment money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back to 
STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
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skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once^|^^^| 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 

STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money a controversial Russian billionaire investor with 

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent by^^^^^J, with the money transferred via Deutsche 
Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52. On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yes[.j I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“Pis call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

57. On or about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 

59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 
“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 
Have some interesting news for you.” 
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J. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


61 . On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts... . 

My Tweet of August 21,2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21,2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assangef] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

63. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. . .. [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE’s 
“Back channel” 
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64. On November 19, 2017, Randy CREDICO (who, as described further below, 

STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the 
fifth. Anything to save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

65. On or about November 21, 2017, CREDICO messaged STONE on Target 
Account 3, “I was told that the house committee lawyer told my lawyer that I will be getting a 
subpoena[.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your 5th Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 
back, “Not the way I remember it - oh well I guess Schiff will try to get one of us indicted for 
perjury[.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth ... 

You want me to cover you for peijury now[.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 
and you can get away with asserting for 5th Amendment rights if u don’t want talk about AND if 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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youturned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjury[.] But I’m sure that wasn’t sworn testimony so you’re probably 
clear[.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot... you should go back ... and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testify[.]” 

71. STONE and CREDICO continued to message each other on or about December l, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email I sent to WikiLeaks website email address asking you would do my 
show[.] That was my initial contact.” 
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74. On or about January 8, 2018, CREDICO messaged STONE on Target Account 3 
stating: “Embassy logs . . . + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

75. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Intel 
committee . . . But you’ll get off because you’re friends with Trump so don’t worry. I have all 
the forensic evidence^] I was not a ba[ck] Channel and I have all those emails from September 
of 2016 to prove it[.]” 

76. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 

have prostate cancer and did not have any such discussion with STONE. 

L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 
the Investigation 

78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 
individuals related to the investigation. 

79. For example, STONE and^^^^^H communicated twice on May 28 and May 

29, 2018 using Target Account a former associate of STONE’s, was 

interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 
and STONE communicated multiple times on May 5, 2018, and STONE 
communicated witf^^^^^| using Target Account 1 on June 1, 2018 and June 6, 2018.^^^ 
a private investigator who had previously worked with STONE and who was hired 
by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 
July 12, 2018. 

80. STONE has also used Target Account 2 to communicate with individuals 
associated with this investigation. 

a. For example, between May 23, 2018 and the present, STONE and CORS1 
exchanged at least five messages using Target Account 2. In the same time period, STONE 
exchanged at least 75 emails with CREDICO using Target Account 2. 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
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(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time ( e.g ., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 

N 

in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 

INFORMATION REGARDING APPLE ID AND iCLOUD 7 


The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://imaees.apple.com/Drivacv/docs/legal-process-guidelines-us.Ddf : “Create and start using an Apple ID,” 
available at https://siinDort.aDDle.com/cn-iis/HT203993 : “iCloud,” available at http://www.apple.com/icloud/ : “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH 12519 : “iOS Security,” available at 
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88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 
the Mac OS operating system. 

89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

c. iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


https://wwvv.apple.com/business/docs/iOS Security Guide.pdf , and “iCloud: How Can I Use iCloud?,” available at 
https://suppoit.apnle.com/kb/PH26502 . 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f. Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

91. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgof ’ pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 
device. 
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95. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 
nonetheless be decrypted by Apple. 

96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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97. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 



Andrew Mitchell 
Special Agent 

Federal Bureau of Investigation 
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Subscribed and sworn to before me on this day of August, 2018. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the email address: 



created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 
at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18U.S.C. 

§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible matenakAhamelat^n any way to 

communications or meetings involving Jerome Co rsi, Julian Assange, 

Ran ndividu a i 

associate^witinn^mnn^Campaign^^^^^^ 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT C 


Property to be Searched 

This warrant applies to information associated with the following Google account: 



created or maintained between October 17, 2017 and the present, that is stored at premises 


owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 
1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 
I. Files and Accounts to be produced by Google, Inc. 

To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private 
messages, and comments; 

k. Google-i- Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, 




ulian Assange, 


Randy Credico, or any individual 


associa 


rump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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ATTACHMENT E 


Property to be Searched 

This warrant applies to information associated with the following Apple DSID: 



created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 
California 95014. 
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ATACHMENT F 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual DP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible material^haUjelat^n any way to 
;ommunication^mneeftng^nvolvin^erom^Corsi, Julian Assange, 

I 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH THREE ) 

ACCOUNTS STORED AT PREMISES CONTROLLED ) 

BY MICROSOFT, GOOGLE, AND APPLE ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the W estern District of _ Wash ington 

(identify the person or describe the property to be searched and give its location)'. 


Case: 1:18-sc-02582 
Assigned To : Howell, Beryl A. 

Assign Date : 8/3/2018 
Description: Search & Seizure Warrant 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _ August 15, 2018 (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_Hon. Beryl A. Howell, Chief U.S. District Judg e_. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed30) □ until, the facts justifying, the later specific date of _. 


Date and time issued: 




City and state: 


Washington, DC 


Judge s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the email address: 



created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 
at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section LA, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access ofaprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materialsthatrelatein any way to 
communicationsormeetingsinvolvingJeromeCorsi,^^^^^^^^^^| Julian Assange, 

Randy Credico, or any individual 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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AO 106 (Rev. 04/10) Application fora Search Warrant 


United States District Court 


12 


for the 

District of Columbia 


FI 

AUG - 3 m 

Clerk, U.S. l?istfict & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY MICROSOFT, 
GOOGLE, AND APPLE 


) Case: 1:18-sc-02583 

Assigned To : Howell, Beryl A. 

) Assign. Date : 8/3/2018 

) Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment C 

located in the Northern District of California_, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment D 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

[?f evidence of a crime; 

[$f contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attachejFsheet. 


) is requested 


Reviewed by AUSA/SAUSA: 


Aaron Zelinsky (ASC) 


Sworn to before me and signed in my presence. 
Date: 






Applicant’s signature 

Andrew Mitchell, Special Agent, FBI 


Printed name and title 



Judge‘s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and title 



Case l:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 8 of 61 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



AUG - 3 m 

U S District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF Case: 1 : 18-SC-02583 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

THREE ACCOUNTS STORED AT Assign. Date : 8/3/2018 

PREMISES CONTROLLED BY Description: Search & Seizure Warrant 

MICROSOFT, GOOGLE, AND APPLE . 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 
1. I make this affidavit in support of an application for a search warrant for 
information associated with the following: 


a. The email account^ 


(hereafter “Target Account 1), that is 


stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 
and in Attachments A and B. 


b. The email account! 


I (hereafter “Target Account 2”), that is 


stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments C and D. 


c. The iCloud account 



ssociated with the Apple email account 


l(hereafter “Target Account 3”), that is stored at premises owned, 
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maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. Asa Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 (J.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

5. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for Roger STONE’ ^^^^Jaddress,^^^^^^^^^^^^^J(Target 
Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s 

address, Account 2). On or about March 14, 2018, Chief 
Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) ... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 

SUMMARY 

7. This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’s Hotmail account; Target Account 2, which is 
STONE’s Gmail account; and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 
scheduled to testify before Congress about interactions with STONE during the 2016 presidential 
campaign or were scheduled to meet with the Special Counsel’s Office 

After STONE learned that one witness, Randy 

CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly 
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urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 
through multiple text messages. In June 2018, STONE instructed his private investigator to 
provide him with a full background investigation on another witness^^^^^^^^^| who had 
done information technology work for STONE during the campaigi^^^^^^^^^^^^j 

9. In September 2017, STONE released a statement he said he provided to Congress 
in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 

to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to contact ASSANGE. On or about August 2, 2016, CORSI 

responded to STONE that the “[w]ord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging.... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 
United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
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Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

c. Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 
tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 

i. Roger STONE 

10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 

11. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 

13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (“USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

b. The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

c. With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 
networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1,2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September/these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

17. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later posted on DCLeaks. 
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18. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
States v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.). 1 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 

/ 

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

-In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 


1 A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 
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22. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJ Stone Jr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

27. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a ‘“mutual acquaintance’ 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

31. On Sunday, October 2,2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
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from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I Hid predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStone Jr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

c. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9,2016, one day after the presidential election, 
@wikilealcs sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

e. In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 
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F. STONE’s Communications with and Others Regarding 

Forthcoming Leaks 

37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search 
for STONE’^^^^J address^^^^^^^^^^^^^J (Target Account 
October 17, 2017, Chief Judge Howell issued a search warrant for STONE’^^^| address, 

(Target Account 2); and on or about March 14, 2018, Chief Judge 
Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 
on or about December 19, 2017, Chief Judge Howell issued a search warrant fo^m^H^ 
email account. Information recovered pursuant to those search warrants includes the following: 

a. On or about May 15, 2016,^^^^^^^ emailed CORSI: “Here is my 
flight schedule. Need to get something confirmed now ....” CORSI responded, “I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1 , who replied to CORSI 
that, “May meet Manafort -guarantee nothing.” 

b. On or about May 1 8 , 2016, CORSI emailed STONE at Target Account 1 

with the title, “Roger — why don’t you look this over before I send I believe that 

CORSI 

HBBWB BB^B^Band I did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

c. On July 25, 2016, STONE, using Target Account 1, sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d. On or about July 31,2016, STONE, using Target Account 1, emailed 

CORSI with the subject line, “Call me MON.” The body of the email read: should see 

Assange[.]^^^^| should find Bernie [SJanders brother who called Bill a Rapist - turn him for 
Trump[.^^^^^| should or more proof of Bill getting kicked out.” 

e. As noted above, on or about August 2,2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke — neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 
[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 


2016. 


f. On or about August 5, 20an associate of STONE’s, 
emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded, “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” subsequently stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet ASSANGE.^^^^^^J also stated 
that in 2018.^^^^^^^ told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE tolc^^^^^^J he was joking and 
had not actually met ASSANGE. 2 

g. On or about August 15, 2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

j. On or about September 6, 2016, CORSI emailed STONE at Target 
Account 1: “Roger[,J Is NY Post going to use the Pedesta [sic] stuff?” 

k. On or about September 24, 2016, emailed CORSI, “I will 

have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 
him about it again today.”wrote back, “Awaiting secret file. Explosive... Hope you 
are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigators^^^^^^^ indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

l. On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote back, 
“It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 
Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 
BS hype.” 
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o. That same day, BANNON emailed STONE at Target Account 2, “What 
was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ clintons???” STONE replied, “Don’t think so BUT his lawyeris a 
big democrat.” 

p. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 

38. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 

According to phone records^^^^^^^^^^^^^^^^^^J at approximately 
11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/31 d74714-8ce5-11 e6-875e-2c 1 bfe943b66_story.html 
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40. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

41. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately 6:27PM,an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded message to CORSI without comment. STONE does not appear 

to have forwarded the email to any other individual. 

H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

46. On or about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed - have to go see T.” CORSI responded to STONE, “Ok. I 
understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-govemment money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back to 
STONE, “Fll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
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skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombankf] The Russians launched a criminal investigation^] [web link] Once^^|^^| 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 

STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money a controversial Russian billionaire investor with 

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent with the money transferred via Deutsche 

Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52. On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yes[.j I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“Pis call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

57. On or about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 

59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 
“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 
Have some interesting news for you.” 
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J. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


61. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assangef] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. 1 asked a journalist who 1 knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

63. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE’s 
“Back channel” 
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64. On November 19, 2017. Randy CREDICO (who, as described further below, 

STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, ‘“Stonewall it. Plead the 
fifth. Anything to save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

65. On or about November 21, 2017, CREDICO messaged STONE on Target 
Account 3, “I was told that the house committee lawyer told my lawyer that I will be getting a 
subpoena[.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your 5th Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 
back, “Not the way I remember it - oh well I guess Schiff will try to get one of us indicted for 
perjury[.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth ... 

You want me to cover you for perjury now[.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 
and you can get away with asserting for 5th Amendment rights if u don’t want talk about AND if 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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you turned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjuryf.] But I’m sure that wasn’t sworn testimony so you’re probably 
clear[.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot... you should go back ... and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testify[.]” 

71. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email I sent to WikiLeaks website email address asking you would do my 
show[.] That was my initial contact.” 
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74. On or about January 8, 2018, CREDTCO messaged STONE on Target Account 3 
stating: “Embassy logs .. . + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

75. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Intel 
committee ... But you’ll get off because you’re friends with Trump so don’t worry. I have all 
the forensic evidence^] I was not a ba[ck] Channel and 1 have all those emails from September 
of 2016 to prove it[.]” 

76. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 

the Investigation 

78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 
individuals related to the investigation. 

79. For example, STONE and^^^^^^J communicated twice on May 28 and May 

29, 2018 using Target Account 1. a former associate of STONE’s, was 

interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 
and STONE communicated multiple times on May 5, 2018, and STONE 
communicated witl^^^^^| using Target Account 1 on June 1, 2018 and June 6, 2018^^^J 
a private investigator who had previously worked with STONE and who was hired 
by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 
July 12, 2018. 

80. STONE has also used Target Account 2 to communicate with individuals 
associated with this investigation. 

a. For example, between May 23, 2018 and the present, STONE and CORS1 
exchanged at least five messages using Target Account 2. In the same time period, STONE 
exchanged at least 75 emails with CREDICO using Target Account 2. 
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81. STONE has also used a phone number associated with Target Account 3 to 
communicate with^^^^^^J a private investigator hired by STONE.^^^^^^Jwas 
interviewed by investigators on June 7, 2018, and subsequently informed investigators that in 
June 2018, STONE instructed him to conduct a full background investigation 

who had been employed by STONE during the Campaign as an information technology 

B HBB B BbMbM BM also told investigators that in June 2018, STONE instructed him to find 

an address for CREDICO that could be used to serve CREDICO with legal process. 
^^^^^^|told investigators that his primary form of communication with STONE is by text 
message on Target Account 3. 

BACKGROUND CONCERNING EMAIL 

82. In my training and experience, I have learned the Providers provide a variety of 
on-line services, including electronic mail (“email”) to the public. The Providers allow 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
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(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time ( e.g ., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 

INFORMATION REGARDING APPLE ID AND iCLOUD 7 


The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/pnvacv/docs/leaal-Drocess-guidelines-us.pdf ; “Create and start using an Apple ID,” 
available at https://sunport.apple.com/en-us/HT203993 ; “iCloud,” available at http://www.apple.com/icloud/ : “What 
does iCloud back up?,” available at htt ps://suppoi1.apple.com/kb/PH 12519 : “iOS Security,” available at 
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88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 
the Mac OS operating system. 

89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (‘^Messages’’) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

c. iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


httDs://w\Yw.apple.com/business/does/iOS Security Guide.pdf . and “iCloud: How Can I Use iCloud?,” available at 
htlns://sunnoil.anple.com/kb/PH26502 . 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f. Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

91. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgof ’ pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 
device. 
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95. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 
nonetheless be decrypted by Apple. 

96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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97. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 



Federal Bureau of Investigation 
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Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the email address: 



created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 
at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 

c; All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 

e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 

f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 

g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 

§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible m aterials that relate in any way to 
communications or meetings involving Jerome C orsi, Julian Assange, 

Randy Credico, or any individual 



c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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ATTACHMENT D 
Particular Things to be Seized 
I. Files and Accounts to be produced by Google, Inc. 

To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 

a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 

b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 

c. All internet search data including all queries and location data; 

d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 

e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 

g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 

h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 

j. YouTube subscriber information, private videos and files, private 
messages, and comments; 

k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 

l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1,2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate i n any way to 

communications or meetings involving Jerome Corsi, Julian Assange, 

Randy Credico, or any individual 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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ATTACHMENT E 


Property to be Searched 

This warrant applies to information associated with the following Apple DSID: 



created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 
California 95014. 
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ATACHMENT F 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 

a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 

b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 

c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 

d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 

f. , All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-bascd access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 

g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 

h. All records pertaining to the types of service used; 

i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 

j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 

Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 

b. All records, information, documents or tangible materials that relate i n any way to 
communications or meetings involving Jerome Corsi,^^^^^^^^^^| Julian Assange, 

R andjUdreoica^HinjH ndivi d u a 1 

associated with the Trump Campaign; 

c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 

e. Evidence of the times the account was used; 

f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 

g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 

h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

i. All existing printouts from original storage which concern the categories identified in 
subsection Il.a 
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AO 93 (Rev 11/J 3) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY GOOGLE 


) 

) Case: 1:18-sc-02595 

) Assigned To : Howell, Beryl A. 

I Assign. Date : 8/8/2018 

) Description: Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)l 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _ August 21,2018 _ (not to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to _ Horu Beryl A. Ho well , Chief U.S. District Judge_. 

(United Stales Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _ _. 


Date and time issued: 


to fa 


City and state: 


Washington, DC 


Judge’s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California: 



- 1 - 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google+ information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1,2015 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, ^^^^^^^^^^Julian 

Randy Credico, or any 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II.a. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 

United States District Court PILED 

for the AUG « 8 2018 

District < 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY GOOGLE 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


Columbia 


Clerk, U.S. District and 
B&nfcruptcyXourJ;*- 

Case: 1:18-sc-02595 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/8/2018 
Description: Search & Seizure Warrant 


See Attachment A 

located in the _ Northern _ District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more): 
tvf evidence of a crime; 

contraband, fruits of crime, or other items illegally possessed; 

[5^ property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached^hect. 


_ ) is requested 


Reviewed by AUSA/SAUSA: 


Kyle R. Freeny (ASC) 


Sworn to before me and signed in my presence. 


Date: 




Applicant's signature 

Andrew Mitchell, Special Agent, FBI 


Printed name and title 




Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and title 
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FILED 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


AUG - 8 2018 

Clerk, U.S. District and 
Bankruptcy Courts 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Assigned To : Howell, Beryl A 
Assign. Date : 8/8/2018 
ascription: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for 

information the Google account (“Target 

Account”), stored at premises owned, maintained, controlled or operated by Google, LLC 
(“Google”), a company headquartered in Mountain View, California. The information to be 
disclosed by Google and searched by the government is described in the following paragraphs and 
in Attachments A and B. 

2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. As a Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. .Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
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abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court). . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
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STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chainnan Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these 6yber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 


- 4 - 
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12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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presidential election, including conspiracy to commit authorized access to protected computers 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
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33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 


- 9 - 



Case l:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 19 of 48 


account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJ Stone Jr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 

“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE^^^^^^^J and Others Regarding 
Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for STONE’s^^^J address^^^^^^^^^^^^^J On October 

17, 2017, Chief Judge Howell issued a search warrant for one of STONE’s^^^ addresses, 

On or about December 19, 2017, Chief Judge Howell issued a search 
warrant foi^^^^^^Js email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 2016,^^^^^^| emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now . ...” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at^^^^^^^^^^^^^Jwho replied to 
CORSI that, “May meet Manafort -guarantee nothing.” 
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43. On or about May 18, 2016, CORSI emailed STONE 


with the title, “Roger -- why don't you look this over before I send | 

I believe that 


>. CORSI wrote, 


and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, usin^^^^^^^^^^^^^^, sent an email 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, usin^^^^^^^^^^^^^|, emailed 

CORSI with the subject line, “Call me MON.” The body of the email read:^^^^^i should see 
Assangef] should find Bemie [Sjanders brother who called Bill a Rapist - turn him for 

Trump[.] should find or more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

“Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
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neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5, 201an associate of STONE’s, emailed 

STONE The email contained a link to a poll indicating that Clinton 

led frump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.”^^^^^^| subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE.^^^^^Jj also stated 
that in 201told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE tolc^^^^^^| he was joking and 
had not actually met ASSANGE. 2 

48. On or about August 15, 2016, CORSI emailed STONE at 

: “Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

49. On or about August 31,2016, CORSI emailed STONE at 

“Did you get the PODESTA writeup.” STONE replied “[y]es.” 
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50. On or about August 31,2016, CORSI messaged STONE, “Podestapaid $180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

51. On or about September 6, 2016, CORSI emailed STONE at 

: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

52. On or about September 24, 2016^^^^^^^ emailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today. 5 ^^^^^^^ wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators.^^^^^^^ indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

53. On or about October 3, 2016, an associate of STONE emailed STONE at 
^^m^and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 
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54. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

55. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

56. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don't think so BUT his lawye^^^^^ is a big 
democrat.” 

57. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 
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58. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

According phone record^^^^^^^^^^^^^^^^^^^, at 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

60. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

61. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

62. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

63. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using “I expect 

that much of next dump focus, setting stage for Foundation debacle.” 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31 d74714-8ce5-11 e6-875e-2c 1 bfe943b66_story.html 
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65. At approximately 6:27Ph^^^^^^^^|L, an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forwarde<^^^^|s message to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

66. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

67. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using^^^^^^^^^^^^^ emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

68. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

with the 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
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“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

69. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via th^^^^^l Account, “Got them and used them.” 

70. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
lik^ll^ skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombankf.] The Russians launched a criminal investigation^] [web link] Onc^H^^^^^ 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombankf.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email with the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
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have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 

a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent b; 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

72. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

73. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

74. On or about October 17, 2016, CORSI emailed STONE at 

with the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 



;, with the money 


then asked, “Just how much money di< 
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kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

75. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

76. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

77. On or about November 8, 2016, the United States presidential election took place. 

78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

79. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 

87. On September 26,2017, STONE testified before the House Permanent Select 

Committee on intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
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such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21,2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

88. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That- 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

89. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
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Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

90. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

91. On or about November 21,2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

92. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff])] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
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interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

93. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

94. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

95. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’... Credico never said he knew or had any information as to source or 
content of the material.” 

96. On or about December 1,2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that 1 was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for peijury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 

4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back ... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testifyf.]” 

97. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

98. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

99. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardonf.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
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email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

100. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that 1 did not have any conversations with 
Assange until September of last year.” 

101. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence^] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

102. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO slated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

103. On or about May 25,2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

K. The Target Account 

104. According to subscriber records obtained from Google, Target Account 

was created on October 27, 2015, in the name 
The recovery email for the Target Account is STONE’^^^^J account, 

Subscriber records obtained in approximately August 2018 indicate 
that the last login to the Target Account occurred on May 17, 2018. 


105. According to subscriber records obtained from Facebook, Target Account 



Counsel’s Office on or about Friday, May 18, 201 told investigators that he 

became STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as 
STONE’s right-hand man. According STONE utilized the services of several 

individuals to post social media content to Facebook and Twitter, and that he and 

STONE both instructed these individuals about what to post.^^^^^J stated that he 
purchased a couple hundred fake Facebook accounts as part of this work (including both new 
and existing accounts), and that bloggers working for STONE would try to build what looked 
like real Facebook accounts. 7 further stated that STONE wanted to push out 


7 Facebook requires that all users of Facebook accounts use their actual name while registering 
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WikiLeaks content through his Facebook and Twitter accounts, and that content related to the 
stolen Podesta emails was pushed out through STONE’s Facebook and Twitter accounts. 

107. On or about August 2, 2018, Chief Judge Howell issued a search warrant for the 

to Target (l:18-sw- 

2570). 

108. Search warrant returns for STONE’s Hotmail account contain a number of emails 
appear have been to Target Accoun^^^^^^^^^^^^^^^^^ from 

entities, including Facebook and Twitter. Although it is not clear from the face of the emails 
how they ended up in STONEaccount, 8 they may have been auto-forwarded or 
otherwise imported from the Target Account into th^^^^Jl account. These emails include at 
least one receipt sent on or about June 30, 2016, from Facebook to the Target Account for a 
Facebook advertisement, which was then forwarded from STONE’^^^^J account to 
Google account. 9 They also include several emails sent from 
to the Target Account early 
BACKGROUND CONCERNING GOOGLE 

109. In my training and experience, I have learned that Google provides a variety of on¬ 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers 

and operating their accounts. The terms of service explicitly require that “Facebook users 
provide their real names and information .... You will not provide any false personal 
information on Facebook, or create an account for anyone other than yourself without 
permission.” 

8 Investigators have been unable to access the full headers for these emails. 

^^^^^Htold investigators that he would sometimes send emails from STONE’s account. 
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obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 
application information. In my training and experience, such information may constitute evidence 
of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

110. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

111. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(/.<?., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
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account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

112. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support sendees, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

113. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

114. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
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alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time ( e.g ., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

FILTER REVIEW PROCEDURES 

115. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
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other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

116. Based on the forgoing, I request that the Court issue the proposed search warrant. 

117. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 


REQUEST FOR SEALING 

118. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 


documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 




Subscribed and sworn to before me on thi 


Andrew Mitchell 
- — Special Agent 

Federal Bureau of Investigation 


day of August, 2018. 




The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California: 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google+ information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1,2015 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

i, Julian 
, or any 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 


communications or meetings involving Jerome Corsi, 


Randy Credico 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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AO 93 (Rev 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY TWITTER 


) Case: 1:18-sc-02596 

) Assigned To : Howell, Beryl A 

Assign. Date : 8/8/2018 
) Description: Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of_ California 

(identify the person or describe the property to be searched and give its location) \ 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 21,2018_ (not to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to _ Hon. Beryl A . Howell, Ch ief U. S. District Jud ge 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _. 

Date and time issued: tZ/ Ai// 4 rnfo _A/ /' ^ 7/// 

Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: 


Washington, DC 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: ___ _ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 
company headquartered in San Francisco, California: 
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ATTACHMENT B 


I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Twitter, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 
information to the government for each account listed in Attachment A: 

A. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 

B. The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 

C. All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 

D. All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 

E. All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 

F. All photographs and images in the user gallery for the account; 

G. All location data associated with the account, including all information collected by the 

“Tweet With Location” service; 

H. All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 

I. All data and information that has been deleted by the user; 

J. A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 

K. A list of all users that the account has “unfollowed” or blocked; 

L. All “lists” created by the account; 
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M. All information on the “Who to Follow” list for the account; 

N. All privacy and account settings; 

O. All records of Twitter searches performed by the account, including all past searches saved 
by the account; 

P. All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 

Q. All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 

R. All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 

S. All data and information associated with the profile page, including photographs; 

T. All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 

U. The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 

V. All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 

W. Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 

X. All activity logs for the account; 

Y. All location information for the account, including all location data collected by any 
plugins or widgets; 

Z. The types of service utilized by the user; 
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AA. All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 

BB. All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 

CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 

DD. All data and information that has been deleted by the user; 

EE. The length of service (including start date) and the means and source of any payments 

associated with the service (including any credit card or bank account number); 

FF. All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 

GG. Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 

HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 

II. All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1, 2015 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II.a. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 


FILED 

AUG - 6 2018 


District of Columbia 


In the Matter of the Search of ^ 

(Briefly describe the property to be searched \ 

or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED j 
BY TWITTER 1 


Clerk, U.S. District and 

Bankrupfcc^eaurts— 

Case: 1:18-sc-02596 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/8/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjuiy that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the Northern _ District of_ Califo rnia _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
ivf evidence of a crime; 

4 contraband, fruits of crime, or other items illegally possessed; 

4 property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


0 Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: _) is requested 

under 18 U.S.C. §3103a, the basis of which is set forth on 


Andrew Mitchell, Special Agent, FBI 

Printed name and title 

Sworn to before me and signed in my presence. 

Date: 

City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 



Reviewed by AUSA/SAUSA: 
Eyle R. Freeny (ASC) 


the attached-sheet. 



Applicant's signature 
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FILED 

IN THE UNITED STATES DISTRICT COURT " 8 2818 

FOR THE DISTRICT OF COLUMBIA Cleric, U S 

Bankrupt?)! Co!Stj nd 

IN THE MATTER OF TI IE SEARCH OF Case: 1 • 1 8-sc-02596 

INFORMATION ASSOCIATED WITH Assigned To • Howell Bervl A 

ONE ACCOUNT STORED AT PREMISES Assign. Date : 8 / 8/2018 

CON TROLLED BY T WITTER_ Description: Search & Seizure Warrant 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with the Twitter account^^^^^^^^^^| (“Target Account”), stored 
at premises owned, maintained, controlled or operated by Twitter, Inc. (“Twitter”), a company 
headquartered in San Francisco, California. The information to be disclosed by Twitter and 
searched by the government is described in the following paragraphs and in Attachments A and B. 

2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. Asa Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
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U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 
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7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 


B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 
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assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
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contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
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Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
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later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17,2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHilIary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a ‘“mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 
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28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. //WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails //HillaryClinton //Podesta //imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
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think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 


- 9 - 



Case l:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 19 of 50 


to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 
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43. On or about May 18, 2016, CORSI emailed STONE 
with the title, “Roger — why don't you look this over before I send I believe that 

CORSI 

sHHHhHBHSBH and 1 did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 
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44. On July 25, 2016, STONE, sent an to 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Gel to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, using^^^^^^^^^^^^Q, emailed 

CORSI with the subject line, “Call me MON.” The body of the email read^^^^^ should see 
Assange[.]^^^^| should find Bemie [Sjanders brother who called Bill a Rapist - turn him for 
Trump[.^|^^^^^ should or more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

“Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 



led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
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Julian Assange last night. subsequently stated to investigators that, around the 

same time, STONE told him he had gone to London to meet ASSANGE^^^^^^^ also stated 
that in 201 told STONE he would be interviewed by the FBI and would have to 

divulge the conversation about meeting ASSANGE. STONE tolc^^^^^^^i he was joking and 
had not actually met ASSANGE. 2 

48. On or about August 15, 2016, CORSI emailed STONE at 

“Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

49. On or about August 31, 2016, CORSI emailed STONE at 

“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

50. On or about August 31,2016, CORSI messaged STONE, “Podestapaid $180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

51. On or about September 6, 2016, CORSI emailed STONE at 

“Roger[,J Is NY Post going to use the Pedesta [sic] stuff?” 
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52. On or about September 24, 201 emailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today^^^^^^^^ wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators.^^^^^^Jl indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

53. On or about October 3, 2016, an associate of STONE emailed STONE at 

and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

54. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 


-14- 





Case l:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 24 of 50 


55. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

56. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don't think so BUT his lawye^^^^J is a big 
democrat.” 

57. When BANNON spoke with investigators during a voluntary interview on 
February 14,2018, he initially denied knowing whether the October 4,2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

58. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31 d74714-8ce5-11 e6-875e-2c 1 bfe943b66_story.html 
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According to phone at approximately 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

60. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

61. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

62. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

63. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 

On or about August 2, 2016, CORSI emailed STONE “I expect 

that much of next dump focus, setting stage for Foundation debacle.” 

65. At approximately 6:27PM^^^^^^^^^, an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forwarded message to CORSI without comment. STONE 

does not appear to have forwarded the email to any other individual. 
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G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

66. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

67. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
usin^^^^^^^^^^^^^ emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

68. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

with 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

69. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 
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70. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

: “PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for apiece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like^^^^^| skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombankf.] The Russians launched a criminal investigation^] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email with the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent with the money 
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transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

72. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

73. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

74. On or about October 17, 2016, CORSI emailed STONE at 

with the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.J I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

75. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 
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76. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

77. On or about November 8, 2016, the United States presidential election took place. 

78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

79. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 





Case l:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 30 of 50 



-21- 





Case l:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 31 of 50 



I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 

87. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
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does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

88. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

89. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 


- 23 - 



Case l:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 33 of 50 


J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

90. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

91. On or about November 21,2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

92. On or about November 24,2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuft[.J 1 just followed his tweets[.J” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well 1 
guess Schiff will try to get one of us indicted for perjury[.]” 
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93. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

94. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

95. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 

96. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 

4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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that wasn’t sworn testimony so you’re probably clearf.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . .. and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before 1 testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

97. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

98. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

99. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would.do my show[.] That was my 
initial contact.” 
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100. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

101. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence^] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

102. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

103. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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Statements Regarding STONE’s Use of Social Media 

104. On or about Friday, May 18,201was voluntarily interviewed 
by investigators from the Special Counsel’s Office^^^^^^J told investigators that he became 
STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’s 
right-hand man. 

105. According STONE utilized the services of several individuals to 

post social media content to Facebook and Twitter, and that he and STONE both 

instructed these individuals about what to post.^^^^^^ stated that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 
and that bloggers working for STONE would try to build what looked like real Facebook 
accounts. 

106. further stated that STONE wanted to push out WikiLeaks content 
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 
was pushed out through STONE’s Facebook and Twitter accounts. 

L. The Target Account 

The Target Account a Twitter account with usemam^^^^^^^^^^^^| 
Search warrant returns for STONE’s Hotmail account contain emails from Twitter about Target 

which appear to have been to 

Although it is not clear from the face of the emails how they 
ended up in STONE’s Hotmail account, 7 they may have been auto-forwarded or otherwise 
imported the Hotmail account. Subscriber records 


7 Investigators have been unable to access the full headers for these emails. 


- 28 - 










Case l:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 38 of 50 


obtained from Google show was registered using STONE’s 

Hotmail addres^^^^^^^^^^^^^n, as the recovery account. 8 

108. Tweets associated with the Target Account, which are publicly available, include 
the retweeting of content related to WikiLeaks, STONE’s testimony before the House 
Intelligence Committee, and the hacking of the DNC. The Target Account was also used to 
retweet content with the hashtag #FreeAssange! The Target Account is listed as having been 
created in March 2016 and bears the picture of a person purporting to 

109. In my training and experience, I know that, in addition to posting content and 
purchasing advertisements, Twitter accounts can be used to communicate privately and directly 
with other users through Twitter’s direct messaging function. As noted above, STONE used at 
least one other Twitter account, @RogerJStoneJr, to communicate with WikiLeaks and 
ASSANGE in 2016 and 2017. 

BACKGROUND CONCERNING TWITTER 

110. Twitter owns and operates a free-access social-networking website of the same 
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users create and read 140-character messages called “Tweets,” 
and to restrict their “Tweets” to individuals whom they approve. These features are described in 
more detail below. 

111. Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 

was also used to register a Facebook account. This Court 
autnonzecn^earcRmnamPaceDook account on or about August 2, 2018 (1:18-sw-2570). 
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characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

112. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

113. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her 
account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

114. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 

115. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 
account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
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the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

116. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

117. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

118. When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

119. A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 
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120. In addition to posting Tweets, a Twitter user can also send Direct Messages 
(DMs) to one of his or her followers. These messages are typically visible only to the sender and 
the recipient, and both the sender and the recipient have the power to delete the message from the 
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a 
particular user, but older DMs are stored on Twitter’s database. 

121. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

122. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 
25 past searches. 

123. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 

124. If a Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 

125. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
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for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

126. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter account activity can show how and when the account was accessed or 
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
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to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

127. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other account 
information. 

FILTER REVIEW PROCEDURES 

128. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

129. Based on the forgoing, I request that the Court issue the proposed search warrant. 

130. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

131. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
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known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Subscribed and sworn to before me on this 


Respectfully subniitted. 


Andrew Mitchell 
Special Agent 

Federal Bureau of Investigation 



day of August, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 
company headquartered in San Francisco, California: 
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ATTACHMENT B 


I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Twitter, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 
information to the government for each account listed in Attachment A: 

A. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 

B. The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 

C. All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 

D. All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 

E. All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 

F. All photographs and images in the user gallery for the account; 

G. All location data associated with the account, including all information collected by the 

“Tweet With Location” service; 

H. All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 

I. All data and information that has been deleted by the user; 

J. A list of all of the people that the user follows on Twitter and all people who are following 

the user (i.e., the user’s “following” list and “followers” list); 

K. A list of all users that the account has “unfollowed” or blocked; 

L. All “lists” created by the account; 
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M. All information on the “Who to Follow” list for the account; 

N. All privacy and account settings; 

O. All records of Twitter searches performed by the account, including all past searches saved 
by the account; 

P. All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 

Q. All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 

R. All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 

S. All data and information associated with the profile page, including photographs; 

T. All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 

U. The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 

V. All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 

W. Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 

X. All activity logs for the account; 

Y. All location information for the account, including all location data collected by any 
plugins or widgets; 

Z. The types of service utilized by the user; 
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AA. All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 

BB. All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 

CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 

DD. All data and information that has been deleted by the user; 

EE. The length of service (including start date) and the means and source of any payments 

associated with the service (including any credit card or bank account number); 

FF. All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 

GG. Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 

HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 

II. All records pertaining to communications between the Service Provider and any person 

regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 
§1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 

period from June 1,2015 to the present, including: 

-4- 



Case l:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 49 of 50 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange,Randy or 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S, person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe (he property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) 

STORED AT PREMISES CONTROLLED BY 1 &1 MAIL ) 

& MEDIA, INC. ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Eastern District of Pennsylvania 

(identify the person or describe the property to be searched and give its location): 

See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before September 3, 201 8 _ (not to exceed 14 days) 

Sf in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to _ Hon. Rudolph Contreras, U.S. District Judge _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of __. 

Date and time issued: 3 !' 0 7 

City and state: Washington, DC Hon. Rudolph Contreras, U.S. District Judge 

Printed name and title 



Case: 1:18-sc-02670 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 
Description. Search & Seizure Warrant 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following 1 &1 Mail account, which 
is stored at premises owned, maintained, controlled, or operated by l&l Mail & Media, Inc., a 
company headquartered in Chesterbrook, Pennsylvania: 
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ATTACHMENT B 

I. Information to be disclosed by l&l Mail 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of l&l Mail & Media, Inc. (the “Provider”), including any messages, records, 
files, logs, or information that have been deleted but are still available to the Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the Provider is required to 
disclose the following information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 

j. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 
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II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud); 
and 52 U.S.C. § 30121 (foreign contribution ban), including: 

a. Evidence of unauthorized access to protected computers; 

b. Evidence of the distribution or transfer of data obtained through unauthorized 
access to protected computers; 

c. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

d. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

e. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

f. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

g. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 
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h. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

i. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
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AO 106 (Rev. 04/10) Application for a Search Warrant 

-T1. V |> 

United States District Court aug 2 o 2ora 

for the Clerk, U.S. Oistrlct & Bankruptcy 

District of Columbia Courts for the D| strict of Columbia 

Case: 1:18-sc-02670 
Assigned To : Howell, Beryl A 
Assign. Date : 8/20/2018 
Description: Search & Seizure Warrant 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the Eastern District of_ Pennsylvania _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


In the Matter of the Search of ^ 

(Briefly describe the property to be searched ) 

or identify the person by name and address) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES CONTROLLED BY 1 &1 MAIL & 

MEDIA, INC. ) 


The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more): 
fflT evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

fif property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1030, 371 Unauthorized Access of Protected Computer, Conspiracy 

See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: ) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
Kyle R. Freeny(ASC) 



Patrick J. Myers, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 
Date: 




Hon. Rudolph Contreras, U.S. District Judge 


City and state: Washington, D.D 


Printed name and title 
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FILED 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


AU6 2 0 2018 

Clerk. U.S. District & Bankruptcy 
Courts for tits District af Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY l&I MAIL & MEDIA, 
INC. 


Case: 1:18-sc-02670 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the account (“Target Account”), stored at 

premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. (“l&l Mail”), a 
company headquartered in Chesterbrook, Pennsylvania. The information to be disclosed by l&l 
Mail and searched by the government is described in the following paragraphs and in Attachments 
A and B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 
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4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 951 (acting as an unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of 
a protected computer), 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). 
There also is probable cause to search the information described in Attachment A for evidence, 
contraband, fruits, and/or instrumentalities of the Subject Offenses, further described in 
Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 

A. Russian Government-Backed Hacking Activity during the 2016 Presidential 
Election 

6. On June 14, 2016, the cybersecurity firm CrowdStrike, Inc. and its affiliates 
(“CrowdStrike”) published a blog post entitled, “Bears in the Midst: Intrusion into the 
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Democratic National Committee.” 1 In the blog post, CrowdStrike described how the firm “was 
called by the Democratic National Committee (DNC), the formal governing body for the US 
Democratic Party, to respond to a suspected breach.” According to CrowdStrike, the cyber actor 
known as “Fancy Bear” breached the DNC network in 2016. CrowdStrike further assessed: 
“Extensive targeting of defense ministries and other military victims [by FANCY BEAR] has 
been observed, the profile of which closely mirrors the strategic interests of the Russian 
government, and may indicate affiliation with rjiaBHoe Pa3Bej^biBaTejiBHoe ynpaBJieHne (Main 
Intelligence Department) or GRU, Russia’s premier military intelligence service.” 

7. Starting in or around mid-2016, published reports also detailed attempts to 
compromise both the work and personal email accounts of numerous individuals involved in the 
2016 U.S. presidential campaign through “spearphishing” efforts. In this context, spear phishing 
refers to the fraudulent practice of sending an email that purports to be from a known or trusted 
sender in order to induce the targeted victim to respond in a desired manner, typically by clicking 
a malicious link or URL. The perpetrators used Bitly, a link-shortening and management service, 
to disguise the malicious URLs. Victims of these spearphishing efforts included John Podesta, the 
chairman of the Clinton Campaign, who received a spearphishing email on or about March 19, 
2016. The email contained a Bitly link created by the Bitly account john356gh, which the FBI has 
linked to a known GRU officer. 

8. On or about September 20, 2016, CrowdStrike also identified a new intrusion into 
the DNC’s virtual private cloud, hosted by Amazon Web Services (AWS). CrowdStrike advised 


1 “Bears in the Midst: Intrusion into the Democratic National Committee,” June 14, 2016, 
available at https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national- 
committee. 
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the FBI that the perpetrators obtained unauthorized access to the DNC’s VPC system through the 
theft of an administrator credential, which gave the perpetrators the ability to modify the network’s 
security rules. After gaining this access, the perpetrators modified the rules that limited the 
universe of devices that could connect to the victim computers. Based on its forensic analysis, 
CrowdStrike determined that the perpetrators copied snapshots of the DNC’s cloud-based 
computers onto at least three new AWS accounts created by the perpetrators. 

9. Following the inception of the spear phishing and intrusion campaigns, a series of 
overlapping actors began to be release documents stolen from the DNC, DCCC, and the personal 
email accounts of campaign-affiliated individuals. Release of these stolen documents principally 
occurred through three forums: (1) a series of accounts operated under the online persona 
“Guccifer 2.0”; (2) a website and series of accounts operated under the online persona “DCLeaks”; 
and (3) the websites and public archives operated by the group “Wikileaks.” The releases of stolen 
documents included confidential memoranda written by Democratic employees; strategy 
documents discussing various components of the 2016 federal elections; and confidential 
correspondences of the DNC and DCCC, as well as individuals involved in the presidential 
campaign of Hillary Clinton. 

10. On January 6, 2017, the US1C released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” 2 In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 


2 “Assessing Russian Activities and Intentions in Recent US Elections,” Jan. 6, 2017, available at 
https ://www.dni .gov/files/documents/ICA_2017_01 .pdf. 
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democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

11. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

12. With respect to hacking activity, the USIC assessed: “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” In addition, “In July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC further assessed that cyber 
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU) 
“resulted in the compromise of the personal e-mail accounts of Democratic Party officials and 
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

13. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release 
US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

14. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
(Case No. l:18-cr-00125). 
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B. Guccifer 2.0’s Use of WikiLeaks to Further the Interference in the 2016 U.S. 

Presidential Election 

15. On June 15, 2016, the day after CrowdStrike publicly attributed the DNC hack to 
Russian government actors, the persona Guccifer 2.0 published its first post on a WordPress 
blog, publicly claiming responsibility for the hack. The post, titled “GUCCIFER 2.0 DNC’S 
SERVERS HACKED BY A LONE HACKER,” contained a number of documents that Guccifer 
2.0 represented as “docs I downloaded from the Democrats network.” Guccifer 2.0 also stated in 
the same post that, with respect to the documents stolen from the DNC, “[t]he main part of the 
papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

16. According to open source information, WikiLeaks is a self-described anti-secrecy 
organization, which is responsible for releasing stolen documents from a number of government 
and non-governmental entities. Julian Assange, an Australian citizen, founded WikiLeaks in or 
around 2006, and he has stated in public interviews that he is deeply involved in running the 
organization. 

17. On or about June 20, 2016, Guccifer 2.0 registered the Twitter account 
@GUCCIFER_2. Search warrant returns for that Twitter account show that Guccifer 2.0 
communicated via direct message with WikiLeaks’ Twitter account, @wikileaks, about the stolen 
DNC documents, including about ways to maximize the impact of the documents on the 2016 
U.S. presidential election. For example, on or about June 22, 2016, WikiLeaks sent a private 
message to Guccifer 2.0, via Twitter, telling Guccifer 2.0 to “[s]end any new material [stolen 
from the DNC] here for us to review and it will have a much higher impact than what you are 
doing.” On or about July 6, 2016, WikiLeaks stated, “if you have anything hillary related we 
want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National 
Convention] is approaching and she will solidify Bernie supporters behind her after.” Guccifer 
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2.0 responded, “ok ... I see.” WikiLeaks explained, “we think trump has only a 25% chance of 
winning against Hillary ... so conflict between Bernie and Hillary is interesting.” 

18. According to information obtained through a court-authorized search of the 
Target Account conducted in or around August 2016, 1 know that on or about July 14, 2016, 
Guccifer 2.0 sent WikiLeaks an email with an attachment titled “wk dnc linkl .txt.gpg.” Search 
warrant returns for the Guccifer 2.0 Twitter account show that Guccifer 2.0 then sent a direct 
message to WikiLeaks that appears to explain that the encrypted file contained instructions on 
how to access an online archive of stolen DNC documents. On or about July 18, 2016, 
WikiLeaks confirmed it had “the 1Gb or so archive” and would make a release of the stolen 
documents “this week.” 

19. On or about July 22, 2016, WikiLeaks released over 20,000 emails and other 
documents stolen from the DNC network. This release occurred approximately three days before 
the start of the Democratic National Convention. WikiLeaks did not disclose Guccifer 2.0’s role 
in providing them. 

20. On or about October 7, 2016, WikiLeaks released the first set of emails that had 
been stolen from John Podesta, chairman of the Clinton Campaign. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately thirty-three tranches 
of documents that had been stolen from Podesta. Based on an assessment of the WikiLeaks 
releases, investigators believe that the total amount of stolen election-related data released by 
WikiLeaks was substantially greater than the 1GB of stolen data apparently contained in the 
online archive provided by Guccifer 2.0, as described above. 


- 7 - 



Case l:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 16 of 33 


21. In an August 2017 interview, ASSANGE indicated that only a small number of 
people, including himself, worked on the release of the DNC emails. 3 Based on public source 
information, I know that ASSANGE made false and misleading statements about the origins of 
the stolen documents, including statements that insinuated that WikiLeaks had received them 
from a recently-deceased DNC employee. 

22. Investigators have learned that WikiLeaks and/or ASSANGE communicated, 
including via intermediaries, about the stolen documents with Roger J. Stone (“STONE”), who 
advised the presidential campaign of Donald J. Trump in 2015 and who remained in contact with 
individuals employed by the campaign through the 2016 election. For example, search warrant 
returns for STONE’s Hotmail account^^^^^^^^^^^^J, show that on or about July 25, 
2016, STONE directed one of his associates, Jerome CORSI, to “[g]et to Assange [a]t the 
Ecuadorian Embassy in London and get the pending WikiLeaks emails ....” On or about July 
31, 2016, Stone reached out again to CORSI, suggesting that he should “see Assange.” A few 
days later, on or about August 2, 2016, CORSI emailed STONE, “Word is friend in embassy 
plans 2 more dumps. One shortly after I’m back 2nd in Oct[ober]. Impact planned to be very 
damaging ...I believe that CORSI’s reference to a “friend in [the] embassy” refers to 
ASSANGE. 

C. The Target Account 

23. According to subscriber information obtained from WordPress in July 2016, the 

Guccifer 2.0 WordPress account was created on June 15, 2016 using 

the email addres^^^^^^^^^^^Hand Target listed as 


3 See https://www.newyorker.com/magazine/2017/08/21 /julian-assange-a-man-without-a-country 
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another email address on the account. Subscriber records for the Target Account indicate that it 
was created on July 23, 2016 in the name of “Guccifer Second.” 

24. The FBI searched the Target Account in approximately August 2016 pursuant to 
a search warrant authorized by the Northern District of California. In approximately September 
2017, the government obtained additional non-content information about the Target Account 
pursuant to 18 U.S.C. § 2703(d), which included header information for the period of time 
between approximately August 2016 and September 2017. The header information shows that 
the Target Account continued to receive emails through at least approximately February 25, 
2017, including emails from WordPress and the file sharing services DropBox and MediaFire, 
which were not captured in the original court-authorized search conducted in August 2016. 

25. Subscriber records obtained from l&l Mail in August 2018 show that the Target 
Account is still active (that is, it has not been deleted). The last login is listed as October 18, 

2016. Records from the Target Account will, among other things, assist investigators in 
understanding Guccifer 2.0’s use of file sharing services, which may in turn assist investigators 
in identifying additional means by which Guccifer 2.0 shared stolen documents with WikiLeaks 
and others. 

BACKGROUND CONCERNING l&l MAIL 

26. In my training and experience, I have learned that l&l Mail provides a variety of 
on-line services, including electronic mail (“email”) access, to the public, l&l Mail allows 
subscribers to obtain email accounts at several domain names, including mail.com, like the Target 
Account. Subscribers obtain an account by registering with l&l Mail. During the registration 
process, l&l Mail asks subscribers to provide basic personal information. Therefore, the 
computers of l&l Mail are likely to contain stored electronic communications (including retrieved 
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and unretrieved email for l&l Mail subscribers and information concerning subscribers and their 
use of l&l Mail services, such as account access information, email transaction information, and 
account application information. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

27. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

28. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(/.«., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, 
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IP address information can help to identify which computers or other devices were used to access 
the email account. 

29. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

30. This application seeks a warrant to search all responsive records and information 
under the control of l&l Mail, a provider subject to the jurisdiction of this court, regardless of 
where l&l Mail has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic communications 
and any records or other information pertaining to the customers or subscribers if such 
communication, record, or other information is within l&l Mail’s possession, custody, or control, 
regardless of whether such communication, record, or other information is stored, held, or 
maintained outside the United States. 

31. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
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the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time ( e.g ., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

32. Because there is probable cause to believe that the Target Account is an 
operational account created to further criminal conduct, this application seeks authorization to 
seize the information in Attachment B from the time of the creation of the account to the present. 

FILTER REVIEW PROCEDURES 

33. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
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with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter team,” 
separate and apart from the investigative team, in order to address potential privileges. The 
government, however, does not at this time anticipate that any of the items described in 
Attachment A will contain materials requiring review by a designated filter team. 


CONCLUSION 


34. Based on the forgoing, I request that the Court issue the proposed search warrant. 

35. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 


REQUEST FOR SEALING 


36. I further request that the Court order that all papers in support of this application, 


including the affidavit and search warrant, be sealed until further order of the Court. These 


documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 



Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 


/■pQ^ dh of August, 2018. 



The Hoiprable Rudolph Contreras 
United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following l&l Mail account, which 
is stored at premises owned, maintained, controlled, or operated by l&l Mail & Media, Inc., a 
company headquartered in Chesterbrook, Pennsylvania: 
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ATTACHMENT B 

I. Information to be disclosed by l&l Mail 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of l&l Mail & Media, Inc. (the “Provider”), including any messages, records, 
files, logs, or information that have been deleted but are still available to the Provider, or have 
been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the Provider is required to 
disclose the following information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All device information associated with the account, including all instrument or 

telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 

j. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 
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II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud); 
and 52 U.S.C. § 30121 (foreign contribution ban), including: 

a. Evidence of unauthorized access to protected computers; 

b. Evidence of the distribution or transfer of data obtained through unauthorized 
access to protected computers; 

c. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

d. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

e. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

f. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

g. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 
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h. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

i. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY l&l MAIL & MEDIA, 
INC. 


Case: 1:18-sc-02670 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 
Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C, 8 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 


disclosure, the proposed Order would direct l&l Mail & Media, Inc. (“l&l Mail”), an electronic 


communication and/or remote computing services provider headquartered in Chesterbrook, 
Pennsylvania, not to notify any other person (except attorneys for l&l Mail for the purpose of 


receiving legal advice) of the existence or content of the Warrant for a period of one year or until 


further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 


1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 
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2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States . .. that - has jurisdiction over the offense being investigated.” 
18 U.S.C. § 271 l(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). l&l Mail provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how l&l Mail may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 


2 
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deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [s/c] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command l&l Mail not to notify any other person (except attorneys for 1 &1 Mail for the purpose 
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating WikiLeaks and others 
for violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an 
unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 

18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 

3 
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and 22 U.S.C. § 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”), in connection with efforts to compromise the networks 
of the Democratic National Convention (“DNC”), the Democratic Congressional Campaign 
Committee (“DCCC”), and the email accounts of U.S. persons involved in the 2016 presidential 
election, followed by the public release of stolen materials through various outlets. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that l&l Mail and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for l&l Mail for the purpose of receiving 
legal advice) for a period of one year or until further order of the Court. Such an order is 
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature 
of which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant 
and related papers may also alert the targets to the scope of information known to the FBI. Once 
alerted to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with l&l Mail, the United States is aware that, absent a 
court order under Section 2705(b) commanding l&l Mail not to notify anyone about a legal 
request, l&l Mail may, upon receipt of a warrant seeking the contents of electronically stored wire 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
1 & 1 Mail not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for l&l Mail for the purpose of receiving legal advice) for a period of one year 
or until further order of the Court. 


Respectfully submitted, 



ROBERT S. MUELLER, III 
Special Counsel ^ - ~) 


Dated: 8A7 q/( ft 


(202)616-3812 
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PILED 

AUG 2 0 2018 


Clerk, U.S. District & Bankruptcy 

IN THE UNITED STATES DISTRICT COURT Court s for the District of Columbia 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY l&l MAIL & MEDIA, 
INC. 


Case: 1:18-sc-02670 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 
Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require l&l Mail & Media, Inc. (“l&l Mail”), an electronic communication and/or remote 
computing services provider headquartered in Chesterbrook, Pennsylvania, not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), l&l Mail and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for l&l Mail for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 



//^ 

THE HONORABLE RUDOLPH CONTRERAS 
UNITED STATES DISTRICT JUDGE 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH ) 

ONE CELLULAR TELEPHONE NUMBER THAT IS ) 

STORED AT PREMISES CONTROLLED BY AT&T ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Southe rn _ District of _ Florida 

(identify the person or describe the property to be searched and give its location)\ 


Case: 1:18-sc-02671 
Assigned To : Howell, Beryl A 
Assign. Date : 8/20/2018 
Description: Search & Seizure Warrant 


See Attachment A 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 3f 2018 _ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _* 


Date and time issued: 





Hon. Rudolph Contreras, U.S. District Judge 


City and state: 


Washington, DC 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the cellular telephone assigned call 
number (“the Account”), that is stores at premises controlled by AT&T (“the 

Provider”), headquartered at 11760 US Highway 1, North Palm Beach, Florida. 


- 1 - 
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ATTACHMENT B 


I. Information to be disclosed by Provider 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider, including any information that has been deleted but is still 
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. 
§ 2703(f), the Provider is required to disclose to the government the following information 
pertaining to the Account listed in Attachment A for the time period June 14, 2016 through 
November 15, 2016: 

a. The following information about the customers or subscribers of the Account: 

i. Names (including subscriber names, user names, and screen names); 

ii. Addresses (including mailing addresses, residential addresses, business 
addresses, and e-mail addresses); 

iii. Local and long distance telephone connection records; 

iv. Records of session times and durations, and the temporarily assigned 
network addresses (such as Internet Protocol (“IP”) addresses) associated 
with those sessions; 

v. Length of service (including start date) and types of service utilized; 

vi. Telephone or instrument numbers (including MAC addresses, Electronic 
Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifier (“MEID”); Mobile Identification Number 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”); International 
Mobile Subscriber Identity Identifiers (“IMSI”), or International Mobile 
Equipment Identities (“IMEI”); 

vii. Other subscriber numbers or identities (including the registration Internet 
Protocol (“IP”) address); and 

viii. Means and source of payment for such service (including any credit card 
or bank account number) and billing records. 


- 2 - 
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b. All records and other information (not including the contents of communications) 
relating to wire and electronic communications sent or received by the Account, 
including: 

i. the date and time of the communication, the method of the 

communication, and the source and destination of the communication 
(such as the source and destination telephone numbers (call detail 
records), email addresses, and IP addresses); and 
ii. information regarding the cell tower and antenna face (also known as 
“sectors”) through which the communications were sent and received. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting), 
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 
(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a 
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to 
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 
14, 2016 to November 15, 2016. 


- 3 - 
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AO 106 (Rev 04/10) Application for a Search Warrant 


United States District Court p | ^ g 


for the 

District of Columbia 


In the Matter of the Search of j 

(Briefly describe the property to be searched \ 

or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE CELLULAR TELEPHONE NUMBER STORED AT 

PREMISES CONTROLLED BY AT&T ) 


AUG 2 0 2018 

Clerk, U.S, District & Bankruptcy 
Courts for the District Of Columbia 

Case: 1:18-sc-02671 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Southern District of_ Florida _, there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

□ property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 

$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:__ 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 

_ 

Rev iewed by AU S A/S AU SA: A I pplicant's signature 

Andrew Mitchell, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 
Date: % j UK? 

City and state: Washington, D.C. 



Judge s signature 

Hon. Rudolph Contreras, U.S. District Judge 


Kyle R. Freeny (ASC) 


) is requested 



Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


FiLEti 

AUG 2 o im 

Clerk, U.S. District & Bankruptcy 
Courts tor the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE CELLULAR TELEPHONE NUMBER 
THAT IS STORED AT PREMISES 
CONTROLLED BY AT&T 


Case: 1:18-sc-02671 
Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant under 18 

U.S.C. § 2703(d) and Federal Rule of Criminal Procedure 41 for information associated with a 
certain cellular telephone assigned call number (“Target Telephone”), which is 

stored at premises owned, maintained, controlled or operated by AT&T, a wireless telephone 
service provider headquartered in North Palm Beach, Florida. The information to be disclosed by 
AT&T and searched by the government is described in the following paragraphs and in 
Attachments A and B. 

2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have been 
since 2011. Asa Special Agent of the FBI, I have received training and experience in investigating 
criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and does 
not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, there 
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is probable cause to believe that violations of the following statutes have been committed or are 
being committed: 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. 
§ 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 1001 (false 
statements), 18 U.S.C. § 1030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. 
§ 30121(a)(1)(C) (foreign expenditure ban). There also is probable cause to search the information 
described in Attachment A for evidence of the Subject Offenses, further described in Attachment 
B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

6. When the Government obtains records under § 2703 pursuant to a search warrant, 
the Government is not required to notify the subscriber or any other person of the warrant, for such 
a period as the Court deems appropriate, where there is reason to believe that such notification will 
seriously jeopardize an investigation. 18 U.S.C. § 2705(b). 

PROBABLE CAUSE 

7. The Special Counsel’s Office, with FBI’s assistance, is investigating the Russian 
government’s efforts to interfere in the 2016 presidential election, as well as any links and/or 
coordination between the Russian government and individuals associated with the campaign of 
President Donald Trump (“Trump Campaign”). This includes investigating Roger Stone (STONE) 
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and others known and unknown, in connection with the hacking of email accounts associated with 
the Democratic National Committee (DNC), Democratic Congressional Campaign Committee 
(DCCC), and individuals involved in the presidential campaign of Hillary Clinton, as well as the 
subsequent dissemination of hacked materials via the persona Guccifer 2.0 and the organization 
WikiLeaks, among others. 

8. This application seeks cell-site location information for the Target Telephone, 
used by STONE, between June 14, 2016 and November 15, 2016. As set forth below, this 
corresponds to the time period during which there is evidence that STONE was engaged in, and 
attempting to engage in, communications, directly or indirectly, with WikiLeaks and its founder 
Julian ASSANGE about the content of stolen documents prior to their public release. During this 
same time period, STONE was also in communications with members of the Trump Campaign. 

A. Background on Relevant Individuals 
i. Roger STONE 

9. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official relationship 
with the Campaign thereafter, STONE maintained his support for Trump and continued to make 
media appearances in support of the Campaign. As described further below, STONE also 
maintained contact with individuals employed by the Campaign, including then-campaign 
chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 

10. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According to 
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publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” for 
the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of books 
regarding Democratic presidential candidates. As described further below, CORSI was in contact 
with STONE during the summer and fall of 2016 regarding forthcoming disclosures of hacked 
information by WikiLeaks, and appears to have obtained information regarding upcoming 
disclosures which he relayed to STONE. 


B. Russian Government-Backed Hacking Activity During the 2016 Presidential Election 

12. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
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assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump. 

13. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

14. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and 
maintained that access until at least June 2016.” The USIC attributed these cyber activities to the 
Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted in the 
compromise of the personal e-mail accounts of Democratic Party officials and political figures. By 
May, the GRU had exfiltrated large volumes of data from the DNC.” 

15. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release 
US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

16. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

17. The Special Counsel’s Office has determined that individuals associated with the 
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GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

18. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals used 
three new accounts with the same cloud computing service to move the “snapshots” to those 
accounts. 

19. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

20. On or about November 1, 2016, individuals associated with the GRU spearphished 
over 100 accounts used by organizations and personnel involved in administering elections in 
numerous Florida counties. 

21. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. Evidence of Google Searches Relating to the Conduct Under Investigation 

22. During the course of its investigation, the FBI has identified a series of searches 
that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona. 
In particular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress 
blog), records from Google show that searches were conducted for the terms “guccifer” and 
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“guccifer june,” from an IP address within the range 107.77.216.0/24. 1 This IP range is assigned 
to AT&T Mobility LLC, and, according to Google, the searches were all conducted from Florida. 

23. IP logs obtained from Twitter show that STONE used multiple IP addresses within 
the range 107.77.216.0/24 to log into his Twitter account @RogerJStoneJr. 

24. Pursuant to a search warrant issued by Chief Judge Beryl A. Howell on or about 
June 13, 2018, the FBI obtained all searches conducted by the CookielDs that conducted the 
Guccifer-related searches described above. 2 Based on these results, the FBI has not yet been able 
to attribute the searches to any particular user. 

D. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

25. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated on 
its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part of 
the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” In 
that post, Guccifer 2.0 also began releasing hacked DNC documents. 

26. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

27. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 


1 Google does not retain full IP addresses for searches conducted more than one year ago. The 
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a 
range of up to 256 IP addresses. 

2 Google assigns unique CookielDs to searches conducted while a user is not logged into a Google 
account. All searches conducted from the same device and browser during a 24-hour window are 
associated with the same CookielD. 
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Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

28. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With regard 
to the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain to 
the Clinton Foundation but there’s no telling what the October surprise may be.” A few days later, 
STONE clarified that while he was not personally in touch with ASSANGE, he had a close friend 
who served as an intermediary. 

29. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

30. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 
2.0’s Twitter account was reinstated. 
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31. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

32. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I believe 
that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton 
aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

34. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

35. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

36. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr to 
tweet: “Payload coming. #Lockthemup.” 

37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link to 
approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

39. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. I 
do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought 
were deleted. I hear that through my emissary.” 

40. On March 27,2017, CNN reported that a representative of WikiLeaks, writing from 
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an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

41. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 3 The latter account is the official Twitter account of WikiLeaks and has been 
described as such by numerous news reports. The message read: “Since I was all over national 
TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents 
and debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

42. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

43. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your operation 
leaks like a sieve. You need to figure out who your friends are.” 

44. On or about November 9, 2016, one day after the presidential election, @wikileaks 


3 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter 
account @RogerJStoneJr. 
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sent a direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks 
immediately followed up with another message less than a minute later: “We are now more free 
to communicate.” 

45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, the 
founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: “Still 
nonsense. As a journalist it doesn’t matter where you get information only that it is accurate and 
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen from 
the government and the courts ruled it was legal to do so and refused to issue an order restraining 
the paper from publishing additional articles. If the US government moves on you I will bring 
down the entire house of cards. With the trumped-up sexual assault charges dropped I don’t know 
of any crime you need to be pardoned for - best regards. R.” That same day, @JulianAssange 
responded: “Between CIA and DoJ they’re doing quite a lot. On the DoJ side that’s coming most 
strongly from those obsessed with taking down Trump trying to squeeze us into a deal.” 

46. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest level 
of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 

F. CORSI’s Communications with STONE, and Others Regarding 

Forthcoming Leaks 

47. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for STONE’address,On October 

2017, Chief Judge Howell issued a search warrant for one of STONE’s^^^Jaddresses, 

MBMHBBi On or about December 19, 2017. Chief Judge Howell issued a search 






Case l:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 19 of 35 


warrant email account. On or about March 14, 2018, Chief Judge Howell issued 

a search warrant for STONE’s iCloud account. Information recovered pursuant to those search 
warrants indicated the following: 

48. On or about May 15, 2016,emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now ....” CORSI responded, “I copied Roger Stone 
so he knows your availability to meet Manafort and DT this coming week.” CORSI appears to 
have forwarded the message to STONE who replied to CORSI that, 

“May meet Manafort -guarantee nothing.” 

49. On or about May 18, 2016, CORSI emailed STONE 

with the title, “Roger — why don't you look this over before I send I believe that 
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tweeted about “Podesta’s time in the barrel”), CORS1 emailed STONE at 

“Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox will 
have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, for now. 
Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential campaign 
to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed 
as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are 
now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — neither he nor 
she well. I expect that much of next dump focus, setting stage for Foundation debacle.” 
Investigators believe that CORSEs reference to a “friend in embassy [who] plans 2 more dumps” 
refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

53. On or about August 4, 2016, an associate of STONE’s, emailed 

STONE The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded on or about the same day, “enjoy it while u can[.] I 
dined with my new pal Julian Assange last night.” subsequently stated to investigators 

that, around the same time, STONE told him he had gone to London to meet ASSANGE. 

also stated that in 2018,^^^H^|told STONE he would be interviewed by the FBI 
and would have to divulge the conversation about meeting ASSANGE. STONE told^^^^^^J 
he was joking and had not actually met ASSANGE. 4 
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54. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to^^^^^^^|to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

55. On or about August 15,2016, CORSI emailed STONE 

“Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not over 
yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m in NYC 
this week. Jerry.” 

56. On or about August 31,2016, CORSI emailed STONE 
“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

57. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by S[b]erbank, 
Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton false narrative 
attempting to tie Trump to Putin.” 

58. On or about September 6, 2016, CORSI emailed STONE at 

“Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

59. On or about September 24, 2016, emailed CORSI, “I will have much 
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more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have secure 
back channel through Roger. I saw him again in NYC last Friday and spoke to him about it again 
today.”wrote back, “Awaiting secret file. Explosive... Hope you are well. Can't wait 
for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted about file[.]” 
In a subsequent meeting with investigators, indicated this conversation concerned 

possible derogatory information he was trying to obtain from Turkey. 

60. On or about October 3, 2016, an associate of STONE emailed STONE at 

asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

61. On or about October 4, 2016, ASSANGE gave a press conference at the Ecuadorian 
Embassy. There had been speculation in the press leading up to that event that ASSANGE would 
release information damaging to then-candidate Clinton, but WikiLeaks did not make any new 
releases. Instead, ASSANGE promised more documents, including information “affecting three 
powerful organizations in three different states, as well as, of course, information previously 
referred to about the U.S. election process.” ASSANGE also stated that WikiLeaks would publish 
documents on various subjects every week for the next ten weeks, and vowed that the U.S. 
election-related documents would all come out before Election Day. 

62. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 
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63. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t cut 
deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer^^^^Jis a big democrat.” 

64. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was 
about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and BANNON 
had been hoping for releases of damaging information that morning. 

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released 

65. According to a publicly available news article, 5 at approximately 11AM on Friday, 
October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from a source 
regarding a previously unaired video of candidate Trump. According to the same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 2005 
segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling Trump’s 
campaign, ‘Access Hollywood,’ and NBC for reaction.” 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

67. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 


5 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31 d74714-8ce5-11 e6-875e-2c 1 bfe943b66_story.html 
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68. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

69. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

70. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

71. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails hacked 

from John Podesta that focused primarily on materials related to the Clinton Foundation. On or 
about August 2, 2016, CORSI emailed STONE using “I expect that 

much of next dump focus, setting stage for Foundation debacle.” 

72. At approximately 6:27PM, an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
im^jHH^^^^^^orwarded message to CORSI without comment. STONE does 

not appear to have forwarded the email to any other individual. 

H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

73. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - have 
to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty minutes 
later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T attacking 
Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job numbers.” 

74. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

emailed Corsi asking him to “send me your best podesta links.” 
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STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on Podesta 
is complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

75. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at botl 

“Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE podesta 
talking points Oct 12 2016.docx.” The “talking points” included the statement that “Podesta is at 
the heart of a Russian-govemment money laundering operation that benefits financially Podesta 
personally and the Clintons through the Clinton Foundation.” 

76. CORSI followed up several minutes later with another email titled, “Podesta talking 
points,” with the text “sent a second time just to be sure you got it.” STONE emailed CORSI back 
via the Hotmail Account, “Got them and used them.” 

77. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 

CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post 
under my by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back 
to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombankf] The Russians launched a criminal investigation!.] [web link] Once ^^^^^|had 
the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s Clinton 
Fund account, there’s no telling how much money he laundered, or where it ended up. Nothing in 



, with the subject line 
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Clinton Foundation audited financials or IRS Form 990s about $$$ received via Russia & 
Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me SOMETHING to 
post on Podesta since I have now promised it to a dozen MSM reportersf.]” 

78. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,J You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, “Just 
how much money did^^^^^^^^^^Ja controversial Russian billionaire investor with ties to 
the Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional 
bank owned 99.978 percent by^^^^^^Jwith the money transferred via Deutsche Bank and 
Trust Company Americas in New York City, with the money ending up in a private bank account 
in the Bank of America that is operated by the Clinton Foundation?” 

79. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s basically 
a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

80. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just landed 
JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important intel to 
share.” 
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81. On or about October 17, 2016, CORSI emailed STONE 

with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, 
“From a very trusted source,” and forwarded an email with the header information stripped out, 
showing only the body text. The email read, “Yes[.j I figured this. Assange is threatening Kerry, 
Ecuador and U.K. He will drop the goods on them if they move to extradite him. My guess is that 
he has a set of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand 
off[.]’ Only hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s 
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange 
has to play out. He’s called Podesta’s bluff and raised him the election.” 

82. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

83. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” STONE 
stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it from 
Wikileaks, although Julian Assange and I share a common friend. I reported the story on my 
website.” STONE linked to the story he had asked CORSI to write for him on October 13, 2016 
discussed above. 

84. On or about November 8, 2016, the United States presidential election took place. 

85. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

86. On or about November 10, 2016, CORSI messaged STONE at his iCloud account, 
“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 
Have some interesting news for you.” 
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I. The Target Telephone 

87. Search warrant returns for STONE’s Hotmail account, 

show that on numerous occasions, including in 2016, STONE provided the Target Telephone 
Number to individuals as his cellular telephone number and/or the way to reach him. On or about 
AT&T, indicated the the 

Target Telephone Number is “Roger J. Stone.” Publicly available databases indicate the Target 
Telephone Number is currently assigned to AT&T wireless and registered to Drake Ventures, a 
company investigators have linked to STONE. 

88. There is evidence that STONE used the Target Phone in connection with the 
conduct under investigation. For example, according to records 

a) STONE called CORSIonorabout July 25,2016 from the Target Phone, and spoke 
with him for approximately twenty-six minutes. Less than roughly two hours after that call, 
STONE emailed CORSI, “Get to Assange [a]t the Ecuadorian Embassy in London and get the 
pending wikileaks emails ....” 

b) On or about July 30, 2016—one day before STONE instructed CORSI to have 
contact ASSANGE—Manafort, who was then-Chairman of the Trump Campaign, 

called STONE on the Target Phone Number. The two spoke for approximately sixty-seven 
minutes. 

c) On or about October 7, 2016, on the day of the Access Hollywood video disclosure, 
STONE received a call from the Washington Post at the Target Phone Number, and shortly 
thereafter, STONE had two conversations with CORSI from the Target Phone Number. 

89. As set forth in Attachment B, this application seeks cell-site location information 
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for the Target Telephone between June 14, 2016 —-the day before a Google search was conducted 
for several Guccifer-related terms from a Florida IP address, followed by Guccifer 2.0’s first public 
appearance—and November 15, 2016 —one week after the 2016 presidential election and less than 
one week after CORSI messaged STONE about having “interesting news” for him. Given 
STONE’s repeated communications with and/or about the WikiLeaks releases during this time, 
including discussions about the content of the documents prior to their release, there is probable 
cause to believe that STONE’s whereabouts during this time period will yield evidence of the 
Subject Offenses under investigation. Location information for the Target Phone will assist 
investigators in determining, among other things: whether STONE was in Florida at the time of 
the Guccifer-related searches; whether STONE met with members of the Trump Campaign at or 
around any of the events or communications discussed above; and where STONE was on the night 
he claimed he “dined” with ASSANGE. 6 Location information will also assist investigators in 
identifying meetings between STONE and any intermediaries to WikiLeaks and/or other potential 
co-conspirators during this time period. 

BACKGROUND CONCERNING AT&T 

90. In my training and experience, I have learned that AT&T is a company that provides 
cellular telephone access to the general public. I also know that providers of cellular telephone 
service have technical capabilities that allow them to collect and generate information about the 
locations of the cellular telephones to which they provide service, including cell-site data, also 

6 As noted above, investigators believe that STONE was in Los Angeles at the time he claimed to 
have met ASSANGE, but the FBI is investigating whether STONE may have met an intermediary 
instead, or otherwise made contact with WikiLeaks. As explained below, the precision of cell-site 
location information varies depending on the distance between towers (among other things). 
Given the density of Los Angeles, I believe that cell-site location data for STONE’s trip there 
would assist investigators in determining, among other things, whether STONE was present at the 
locations he has publicly claimed to have been. 
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known as “tower/face information” or “cell tower/sector records.” Cell-site data identifies the 
“cell towers” (i.e., antenna towers covering specific geographic areas) that received a radio signal 
from the cellular telephone and, in some cases, the “sector” (i.e., faces of the towers) to which the 
telephone connected. These towers are often a half-mile or more apart, even in urban areas, and 
can be 10 or more miles apart in rural areas. Furthermore, the tower closest to a wireless device 
does not necessarily serve every call made to or from that device. Accordingly, cell-site data 
provides an approximate location of the cellular telephone but is typically less precise than other 
types of location information, such as E-911 Phase II data or Global Positioning Device (“GPS”) 
data. 

91. Based on my training and experience, I know that AT&T can collect cell-site data 
about the Target Telephone. Cell-site location data is typically generated only when the phone 
is used to engage in communications. I also know that wireless providers such as AT&T typically 
collect and retain cell-site data pertaining to cellular phones to which they provide service in their 
normal course of business in order to use this information for various business-related purposes. 

92. Based on my training and experience, I know that wireless providers such as 
AT&T typically collect and retain information about their subscribers in their normal course of 
business. This information can include basic personal information about the subscriber, such as 
name and address, and the method(s) of payment (such as credit card account number) provided 
by the subscriber to pay for wireless telephone service. I also know that wireless providers such 
as AT&T typically collect and retain information about their subscribers’ use of the wireless 
service, such as records about calls or other communications sent or received by a particular 
phone and other transactional records, in their normal course of business. In my training and 
experience, this information may constitute evidence of the crimes under investigation because 
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the information can be used to identify the Target Telephone user or users and may assist in the 
identification of co-conspirators and/or victims 

FILTER REVIEW PROCEDURES 

93. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter team,” 
separate and apart from the investigative team, in order to address potential privileges. The 
government, however, does not at this time anticipate that any of the items described in 
Attachment A will contain materials requiring review by a designated filter team. 

CONCLUSION 

94. Based on the forgoing, I request that the Court issue the proposed search warrant. 

95. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 

96. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 


documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 



Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on 


this day of August, 2018. 



The Honorable Rudolph Contreras 
United States District Judge 


- 26 - 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the cellular telephone assigned call 
number (“the Account”), that is stores at premises controlled by AT&T (“the 

Provider”), headquartered at 11760 US Highway 1, North Palm Beach, Florida. 


- 1 - 
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ATTACHMENT B 


I. Information to be disclosed by Provider 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider, including any information that has been deleted but is still 
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. 
§ 2703(f), the Provider is required to disclose to the government the following information 
pertaining to the Account listed in Attachment A for the time period June 14, 2016 through 
November 15, 2016: 

a. The following information about the customers or subscribers of the Account: 

i. Names (including subscriber names, user names, and screen names); 

ii. Addresses (including mailing addresses, residential addresses, business 
addresses, and e-mail addresses); 

iii. Local and long distance telephone connection records; 

iv. Records of session times and durations, and the temporarily assigned 
network addresses (such as Internet Protocol (“IP”) addresses) associated 
with those sessions; 

v. Length of service (including start date) and types of service utilized; 

vi. Telephone or instrument numbers (including MAC addresses, Electronic 
Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifier (“MEID”); Mobile Identification Number 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”); International 
Mobile Subscriber Identity Identifiers (“IMSI”), or International Mobile 
Equipment Identities (“IMEI”); 

vii. Other subscriber numbers or identities (including the registration Internet 
Protocol (“IP”) address); and 

viii. Means and source of payment for such service (including any credit card 
or bank account number) and billing records. 
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b. All records and other information (not including the contents of communications) 
relating to wire and electronic communications sent or received by the Account, 
including: 

i. the date and time of the communication, the method of the 

communication, and the source and destination of the communication 
(such as the source and destination telephone numbers (call detail 
records), email addresses, and CP addresses); and 
ii. information regarding the cell tower and antenna face (also known as 
“sectors”) through which the communications were sent and received. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting), 
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 
(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a 
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to 
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 
14, 2016 to November 15, 2016. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) 

STORED AT PREMISES ) 

CONTROLLED BY FACEBOOK ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)'. 


Case: 1:18-sc-02727 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date : 8/28/2018 

Description: Search and Seizure Warrant 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B 

I 


YOU ARE COMMANDED to execute this warrant on or before September 11,2018 _ (not to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.in. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ Hon. James E. Boasberg, U.S. District Judge _. 

(United States Magistrate Judge) 

□ Pursuant to 18U.S.C. § 3103 a(b), I find that immediate notification may have an adverse result listed in 18U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box),' 

□ for days (not to exceed 30) □ until, the facts justifying, the later specific date of 

71 

Date and time issued: j ‘3/ _ 

City and state: Washington, DC _ Hon __ 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


1 declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ ____________ 

Executing officer *s signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the Facebook accounts registered to 
the following email addresses, stored at premises owned, maintained, controlled, or operated by 
Facebook, Inc. (“Facebook”), a company headquartered in Menlo Park, California: 



- 1 - 
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ATTACHMENT B 

I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook, Inc. (“Facebook”), including any messages, records, files, logs, 
or information that have been deleted but are still available to Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the 
following information to the government for each account listed in Attachment A: 

(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 

(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; Mend lists, including 
the Mends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 
tags; and information about the user’s access and use of Facebook applications; 
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(e) All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

(f) All records relating to machine cookies; 

(g) All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

(h) All IP logs, including all records of the IP addresses that logged into the account; 

(i) All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

(j) All information about the Facebook pages that the account is or was a “fan” of; 

(k) All past and present lists of friends created by the account; 

(l) All records of Facebook searches performed by the account; 

(m) All information about the user’s access and use of Facebook Marketplace; 

(n) The types of service utilized by the user; 

(o) The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

(p) Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

(q) All past and present Admins for the group; 

(r) The “Creator” of the group; 
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(s) All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

(t) All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

(u) All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected and queried. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1, 2015 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange,Randy or 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 


-5- 



Case l:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 8 of 56 


j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

' 1. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


AUG 2 8 2018 

Usik, U.S. District & Bankruptcy 
Courts ter ths District of CahuuniH 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY FACEBOOK 


Case: 1:18-sc-02727 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Facebook, Inc. (“Facebook”), an electronic communication and/or remote 
computing services provider headquartered in Menlo Park, California, not to disclose the existence 
or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence ofthe Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Facebook and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Facebook for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 
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United States District Court 

for the 



District of Columbia Clerk, U.S. District & Bankruptcy 

Courts tor the District ot Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY FAC EBOOK 


} Case: 1:18-sc-02727 

j Assigned To : Chief Judge Beryl A. Howell 

) Assign. Date : 8/28/2018 

) Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the Northern _ District of ' _C alifornia _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P.41 (c) is (check one or more)'. 
evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001,1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: 



Kyle R. Freeny (ASC) 


Applicant's signature 

Curtis Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 
Date: 

City and state: Washington, D.C. __ 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY FACEBOOK 


Case: 1:18-sc-02727 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. $ 2705fbf 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b), In regard to the non¬ 
disclosure, the proposed Order would direct Facebook, Inc. (“Facebook”), an electronic 
communication and/or remote computing services provider headquartered in Menlo Park, 
California, not to notify any other person (except attorneys for Facebook for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Postv. Robinson, 935 F.2d 282,287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit tenns of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1,5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Facebook not to notify any other person (except attorneys for Facebook for the purpose 
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 

§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 

Offenses”), in connection with efforts to compromise the networks of the Democratic National 

3 
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to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Facebook, the United States is aware that, absent a 
court order under Section 2705(b) commanding Facebook not to notify anyone about a legal 
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored wire 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Facebook not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year 
or until further order of the Court. 

Respectfully submitted, 

ROBERT S. MUELLER, III 

Dated: 

(202)616-3812 
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AUG 2 B 2018 

IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy 
FOR THE DISTRICT OF COLUMBIA Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY FACEBOOK 


Case: 1:18-sc-02727 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Curtis Heide, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with the Facebook account registered to 

(“Target Account”), stored at premises owned, maintained, controlled or operated by Facebook, 
Inc. (“Facebook”), a company headquartered in Menlo Park, California. The information to be 
disclosed by Facebook and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

2. I have been a Special Agent with the Federal Bureau of investigation for 12 years. 
In the course of my duties, I have been responsible for investigating federal crimes and national 
security matters involving both counterintelligence and issues related to cyber security. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
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abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
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STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6,2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Govermnent agencies, state-funded media, third-party 
intermediaries, and paid Social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 
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12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1,2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4,2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, etal. (Case No. l:18-cr-00125). 

C. STONE’s public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14,2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15,2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22,2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8,2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13,2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21,2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Info wars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryCIinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
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33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8,2016. On October 12,2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27,2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
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account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9,2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4,2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


1 On or about August 7,2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10,2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE, Others Regarding 

Forthcoming Leaks 

41. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 

issued a search warrant for STONE’s address, October 

17,2017, Chief Judge Howell issued a search warrant for one of STONE’s 
j^^^Hion or about December 19, 2017, Chief Judge Howell issued a search 
warrant for^^^^^^^^^mail account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 2016, ^^^^^^emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now ...CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 
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waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 


44. On July 25, 2016, STONE, using an email to 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, using emailed 

CORSI with the subject line, “Call me MON.” The body of the email read: should see 

Assangef.] should find Bernie [Sjanders brother who called Bill a Rapist — turn him for 

Trump[.j should find^^^^^^^^|or more proof of Bill getting kicked out.” 

46. On or about August 2,2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC, That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
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information indicating that it was taken in Los Angeles. 

49. On or about August 15,2016, CORSI emailed STONE at 

“Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31,2016, CORSI emailed STONE at 

“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 

1 Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24,2016,^^^^^^^|emailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” j^^^^^Jwrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators,indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

54. On or about October 3,2016, an associate of STONE emailed STONE at 

and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
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back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE at“What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don't think so BUT his lawyer^^^^|is a big 
democrat.” 

58. When BANNON spoke with investigators during a voluntary interview on 
February 14,2018, he initially denied knowing whether the October 4, 2016 email to STONE 
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was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7,2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake ol footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone records at approximately 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31d74714-8ce5-lle6-875e-2clbfe943b66_story.html 
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65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using^^^^^^^^^^^^^|“I expect 
that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM, an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forwarded ^^^^^^Jmessage to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

67. On or about October 8,2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 
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69. On or about that same day, October 12,2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13,2016, CORSI emailed STONE at 



“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 


CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like ^^^^^^^skimmed maybe billions off Skolkovo —- Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation^] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 
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72. On or about Thursday, October 13,2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by with the money 

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “Pm in NYC. Thinking about writing piece attacking Leer and other women. IPs 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

75. On or about October 17, 2016, CORSI emailed STONE at 


with the subject, “Fwd: 
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ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otheiwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18,2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important,” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8,2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
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I. STONE’S Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 
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88. On September 26,2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12,2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

89. In a document dated March 26,2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 


- 23 - 




Case l:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 38 of 56 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19,2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, ‘“Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 
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93. On or about November 24,2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a lucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjuryf.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28,2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27,2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29,2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12,2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 
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97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for perjury 
now[.j” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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99. On or about December 13,2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8,2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25,2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence^] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13,2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
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104. On or about May 25,2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9,2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

K^^^^^^^^^Statements Regarding STONE’s Use of Social Media 

105. On or about Friday, May 18, 2018 was voluntarily interviewed 

by investigators from the Special Counsel’s Office. ^^^^^^^old investigators that he became 
STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’s 
right-hand man. 7 

106. According t<^^^^^^^STONE utilized the services of several individuals to 
post social media content to Facebook and Twitter, and that he^^^^^^^Jand STONE both 
instructed these individuals about what to post, ^^^^^^^tated that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 
and that bloggers working for STONE would try to build what looked like real Facebook 
accounts. 

107. further stated that STONE wanted to push out WikiLeaks content 
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 
was pushed out through STONE’s Facebook and Twitter accounts. 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 

oId investigators that he would sometimes send emails from STONE’s account. 
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108. In or around August 2018, pursuant to a warrant issued by Chief Judge Howell, 
the FBI searched several Facebook accounts associated with STONE, which (among other 
things) were used to purchase Facebook advertisements. Search warrant returns for one of those 
account 

campaign on or about August 26,2016, that included the text, “The Democrats are right to fear 
Assange’s next email drops will be devastating to Hillary.” The same account was also used to 
create and run a Facebook ad campaign on or about March 28,2017, that included the following 
text: “ROGER STONE - NO consensus that Guccifer 2.0 is a ‘Russian Asset’ just because US 
Intel says he is.” 

L. The Target Account 

109. According to subscriber records, the email account 

was created on August 17, 2015, in the name of “Falo Memo Tio.” 8 STONE’s Hotmail account 
is listed as the recovery email for the account. In my training and 
experience, when setting up a new email account, users typically provide an email account under 
their control as the recovery account in order to ensure continued access to the new account, for 
example, in the event a password is lost or compromised. Accordingly, there is probable cause 
to believe that STONE controls (directly, or through an employee or associate) the email account 



110. The government obtained non-content information associated with the 

pursuant to an order issued by Chief Judge Howell under 18 U.S.C. 


8 Subscriber records list the “Language Code” for the email account as “pt_BR.” I believe this 
indicates that the subscriber selected Brazilian Portuguese as the primary language for the 
account. Based on machine translation, the customer name “Falo Memo Tio” translates from 
Portuguese to “I speak Memo Uncle.” 




Ishowthat STONE or one of his associates created an ad 
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§ 2703(d). Although subscriber records indicate that the last login to the email account took 
place on August 18, 2015, header information shows that the account continued to receive emails 
until at least July 27, 2018, including from companies that offer advertisement placements. 

111. Header information shows that the email account received multiple emails from 
Facebook between approximately November 3, 2016 and November 7, 2016, shortly before the 
U.S. presidential election. On or about October 5, 2016, the email account also received an 
email from adsense-noreply@google.com, an account that I believe is associated with Google 
AdSense. According to open source information, Google AdSense is a program that matches ads 
to websites based on their content and visitors, and it allows individuals to place targeted 
advertising on its network of content sites. 

112. Based on a query performed through Facebook’s law enforcement portal, the FBI 

has confirmed that the email account is registered to an active 

Facebook account. As explained further below, in my training and experience, I know that, in 
addition to posting content and purchasing advertisements, Facebook accounts can be used to 
communicate privately and directly with other users through Facebook’s messaging function. 

This function is similar to the direct messaging function of Twitter, which STONE used to 
communicate with WikiLeaks and ASSANGE in 2016 and 2017. 

BACKGROUND CONCERNING FACEBOOK 

113. Facebook owns and operates a free-access social networking website of the same 
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish 
accounts with Facebook, and users can then use their accounts to share written news, photographs, 
videos, and other information with other Facebook users, and sometimes with the general public. 


- 30 - 







Case l:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 45 of 56 

114. Facebook asks users to provide basic contact and personal identifying information 
to Facebook, either during the registration process or thereafter. This information may include the 
user’s full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook 
security questions and answers (for password retrieval), physical address (including city, state, and 
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook 
also assigns a user identification number to each account. 

115. Facebook users may join one or more groups or networks to connect and interact 
with other users who are members of the same group or network. Facebook assigns a group 
identification number to each group. A Facebook user can also connect directly with individual 
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request” 
accepts the request, then the two users will become “Friends” for purposes of Facebook and can 
exchange co mmuni cations or view information about each other. Each Facebook user’s account 
includes a list of that user’s “Friends” and a “News Feed,” which highlights information about the 
user’s “Friends,” such as profile changes, upcoming events, and birthdays. 

116. Facebook users can select different levels of privacy for the communications and 
information associated with their Facebook accounts. By adjusting these privacy settings, a 
Facebook user can make inf ormation available only to himself or herself, to particular Facebook 
users, or to anyone with access to the Internet, including people who are not Facebook users. A 
Facebook user can also create “lists” of Facebook friends to facilitate the application of these 
privacy settings. Facebook accounts also include other account settings that users can adjust to 
control, for example, the types of notifications they receive from Facebook. 

117. Facebook users can create profiles that include photographs, lists of personal 
interests, and other information. Facebook users can also post “status” updates about their 
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whereabouts and actions, as well as links to videos, photographs, articles, and other items available 
elsewhere on the Internet. Facebook users can also post information about upcoming “events,” 
such as social occasions, by listing the event’s time, location, host, and guest list. In addition, 
Facebook users can “check in” to particular locations or add their geographic locations to their 
Facebook posts, thereby revealing their geographic locations at particular dates and times. A 
particular user’s profile page also includes a “Wall,” which is a space where the user and his or 
her “Friends” can post messages, attachments, and links that will typically be visible to anyone 
who can view the user’s profile. 

118. Facebook allows users to upload photos and videos, which may include any 
metadata such as location that the user transmitted when s/he uploaded the photo or video. It also 
provides users the ability to “tag” (i.e., label) other Facebook users in a photo or video. When a 
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the 
photo or video. For Facebook’s purposes, the photos and videos associated with a user’s account 
will include all photos and videos uploaded by that user that have not been deleted, as well as all 
photos and videos uploaded by any user that have that user tagged in them. 

119. Facebook users can exchange private messages on Facebook with other users. 
These messages, which are similar to e-mail messages, are sent to the recipient’s “Inbox” on 
Facebook, which also stores copies of messages sent by the recipient, as well as other information. 
Facebook users can also post comments on the Facebook profiles of other users or on their own 
profiles; such comments are typically associated with a specific posting or item on the profile. In 
addition, Facebook has a Chat feature that allows users to send and receive instant messages 
through Facebook. These chat communications are stored in the chat history for the account. 


- 32 - 





Case l:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 47 of 56 


Facebook also has a Video Calling feature, and although Facebook does not record the calls 
themselves, it does keep records of the date of each call. 

120. If a Facebook user does not want to interact with another user on Facebook, the 
first user can “block” the second user from seeing his or her account. 

121. Facebook has a “like” feature that allows users to give positive feedback or connect 
to particular pages. Facebook users can “like” Facebook posts or updates, as well as webpages or 
content on third-party (i.e., non-Facebook) websites. Facebook users can also become “fans” of 
particular Facebook pages. 

122. Facebook has a search function that enables its users to search Facebook for 
keywords, usernames, or pages, among other things. 

123. Each Facebook account has an activity log, which is a list of the user’s posts and 
other Facebook activities from the inception of the account to the present. The activity log includes 
stories and photos that the user has been tagged in, as well as connections made through the 
account, such as “liking” a Facebook page or adding someone as a friend. The activity log is 
visible to the user but cannot be viewed by people who visit the user’s Facebook page. 

124. Facebook Notes is a blogging feature available to Facebook users, and it enables 
users to write and post notes or personal web logs (“blogs”), or to import their blogs from other 
services, such as Xanga, LiveJournal, and Blogger. 

125. The Facebook Gifts feature allows users to send virtual “gifts” to their friends that 
appear as icons on the recipient’s profile page. Gifts cost money to purchase, and a personalized 
message can be attached to each gift. Facebook users can also send each other “pokes,” which are 
free and simply result in a notification to the recipient that he or she has been “poked” by the 
sender. 
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126. Facebook also has a Marketplace feature, which allows users to post free classified 
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace. 

127. In addition to the applications described above, Facebook also provides its users 
with access to thousands of other applications (“apps”) on the Facebook platform. When a 
Facebook user accesses or uses one of these applications, an update about that the user’s access or 
use of that application may appear on the user’s profile page. 

128. Some Facebook pages are affiliated with groups of users, rather than one individual 
user. Membership in the group is monitored and regulated by the administrator or head of the 
group, who can invite new members and reject or accept requests by users to enter. Facebook can 
identify all users who are currently registered to a particular group and can identify the 
administrator and/or creator of the group. Facebook uses the term “Group Contact Info” to 
describe the contact information for the group’s creator and/or administrator, as well as a PDF of 
the current status of the group profile page. 

129. Facebook uses the term “Neoprint” to describe an expanded view of a given user 
profile. The “Neoprint” for a given user can include the following information from the user’s 
profile: profile contact information; News Feed information; status updates; links to videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends’ 
Facebook user identification numbers; groups and networks of which the user is a member, 
including the groups’ Facebook group identification numbers; future and past event postings; 
rejected “Friend” requests; comments; gifts; pokes; tags; and information about the user’s access 
and use of Facebook applications. 

130. Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP address. 
These logs may contain information about the actions taken by the user ID or IP address on 
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Facebook, including information about the type of action, the date and time of the action, and the 
user ID and IP address associated with the action. For example, if a user views a Facebook profile, 
that user’s IP log would reflect the fact that the user viewed the profile, and would show when and 
from what IP address the user did so. 

131. Social networking providers like Facebook typically retain additional information 
about their users’ accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the service 
(including any credit card or bank account number). In some cases, Facebook users may 
communicate directly with Facebook about issues relating to their accounts, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 
Facebook typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. 

132. As explained herein, information stored in connection with a Facebook account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Facebook user’s “Neoprint,” IP log, stored electronic communications, and other data retained by 
Facebook, can indicate who has used or controlled the Facebook account. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a search warrant 
at a residence. For example, profile contact information, private messaging logs, status updates, 
and tagged photos (and the data associated with the foregoing, such as date and time) may be 
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook 
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account activity can show how and when the account was accessed or used. For example, as 
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their 
accounts along with the time and date. By determining the physical location associated with the 
logged IP addresses, investigators can understand the chronological and geographic context of the 
account access and use relating to the crime under investigation. Such information allows 
investigators to understand the geographic and chronological context of Facebook access, use, and 
events relating to the crime under investigation. Additionally, Facebook builds geo-location into 
some of its services. Geo-location allows, for example, users to “tag” their location in posts and 
Facebook “friends” to locate each other. This geographic and timeline information may tend to 
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may 
provide relevant insight into the Facebook account owner’s state ot mind as it relates to the offense 
under investigation. For example, information on the Facebook account may indicate the owner’s 
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from 
law enforcement). 

133. Therefore, the computers of Facebook are likely to contain all the material 
described above, including stored electronic communications and information concerning 
subscribers and their use of Facebook, such as account access information, transaction information, 
and other account information. 

FILTER REVIEW PROCEDURES 

134. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
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other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

135. Based on the forgoing, I request that the Court issue the proposed search warrant. 

136. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

137. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 

Curtis Heide 

Special Agent 

Federal Bureau of Investigation 

Subscribed and sworn to before me on this day of August, 2018. 




-37- 






Case l:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 52 of 56 


ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Facebook accounts registered to 
the following email addresses, stored at premises owned, maintained, controlled, or operated by 
Facebook, Inc. (“Facebook”), a company headquartered in Menlo Park, California: 
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ATTACHMENT B 

I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook, Inc. (“Facebook”), including any messages, records, files, logs, 
or information that have been deleted but are still available to Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the 
following information to the government for each account listed in Attachment A: 

(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 

(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 
tags; and information about the user’s access and use of Facebook applications; 
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(e) 


(f) 

(g) 

(h) 
0 ) 

G) 

(k) 

( l ) 

(m) 

(n) 

(o) 


(P) 


(q) 

(r) 


All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

All records relating to machine cookies; 

All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

All IP logs, including all records of the IP addresses that logged into the account; 
All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

All information about the Facebook pages that the account is or was a “fan” of; 

All past and present lists of friends created by the account; 

All records of Facebook searches performed by the account; 

All information about the user’s access and use of Facebook Marketplace; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

All past and present Admins for the group; 

The “Creator” of the group; 
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(s) All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

(t) All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

(u) All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected and queried. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1, 2015 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, 

/ 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) 

STORED AT PREMISES ) 

CONTROLLED BY GOOGLE ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)'. 


Case: 1:18-sc-02728 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


See Attachment A 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before September 11, 2018 (not to exceed 14 days) 
5^ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_ Hon. James E. Boasberg, U.S. District Judge 


(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

a for_days (not to exceed 30) □ until, the facts justifying, the later specific date of 


Date and time issued: 


City and state: 



i/a 


v* 


Washington, DC 



Hon. J$mes/£. Boasberg, U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California: 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google+ information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1,2015 to the present, including: 
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a. AH records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy or any 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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iiavnHiii/fli 


United States District Court 


for the 

District of Columbia 


AUG 2 8 2018 


Clerk, U.S. District & Bankruptcy 
Courts tor the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY GOOGLE 


Case: 1:18-sc-02728 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Northern _ District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 

fif contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001,1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


Qf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 



Printed name and title 


Sworn to before me and signed in my presence. 
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AUG 2 8 2018 

IN THE UNITED STATES DISTRICT COURT Clerk, ^8 District & Bankruptcy 
FOR THE DISTRICT OF COLUMBIA ftS for the Dlstrict of Columb| a 

Case: 1:18-sc-02728 
Assigned To : Chief Judge Beryl A. Howell 
Assign. Date: 8/28/2018 
Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY GOOGLE 



I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for 

information associated with the Google account Account”), 

stored at premises owned, maintained, controlled or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California. The information to be disclosed by Google 
and searched by the government is described in the following paragraphs and in Attachments A 
and B. 

2. I have been a Special Agent with the Federal Bureau of investigation for 12 years. 
In the course of my duties, I have been responsible for investigating federal crimes and national 
security matters involving both counterintelligence and issues related to cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
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abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) ... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 


\ 
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STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6,2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 
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12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election, 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4,2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, etal. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22,2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8,2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12,2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStone Jr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18,2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon tlie [sic] Podesta’s time in the barrel. //CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2,2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of-the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5,2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
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33. WikiLeaks continued to release Jo h n Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12,2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13,2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 




Case l:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 19 of 49 


account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R .” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \" correct?' me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9,2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Commu n ications with STONE, Others Regarding 

Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE’s^^^J address,On October 
17, 2017, Chief Judge Howell issued a search warrant for one of STONE’s ^^Jaddresses, 

On or about December 19, 2017, Chief Judge Howell issued a search 
warrant for^^^^^^^email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15,2016,^^^^^^ emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now....” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at who replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 
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43. On or about May 18,2016, CORSI emailed STONE 
with the title, “Roger — why don't you look this over before I send I believe that 



waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 


44. On July 25,2016, STONE, using sent an email to 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” 

45. On or about July 31,2016, STONE, using^^^^^^^^^^^^^|emailed 

CORSI with the subject line, “Call me MON.” The body of the email read: should see 

Assange[.] ^^^^^should find Bernie (SJanders brother who called Bill a Rapist - turn him for 
Trump[.] ^^^^^hould find or more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

“Word is friend in embassy plans 2 more dumps. One shortly after Em 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games, Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
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/ 

neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5,2016,^^^^^^^^Jan associate of STONE’s, emailed 

STONE The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” subsequently stated to investigators that, around the 

same time, STONE told him he had gone to London to meet ASSANGE. also stated 

that in 2018, ^^^^^Jtold STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told was joking and 

had not actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to have “dined” with ASSANGE. For example, an associate of 

STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded, “It’s this aftemoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
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STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 

“Give me a today if you can. Despite MSM drumroll that HRC is 

already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 
■MB “ Did you S ct the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6,2016, CORSI emailed STONE at 

“Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24,201emailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” ^^^^^^Jwrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, indicated this 

conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 
and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4,2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well aS, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4,2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer is a big 

democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14,2018, he initially denied knowing whether the October 4,2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7,2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

According to phone records^^^^^^^^^^^^^^^| at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 

then-the-race-was-on/2016/10/07/31 d74714-8ce5-l 1 e6-875e-2clbfe943b66story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using^^^^^^^^^^^^^“I expect 
that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM,an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forwarded |^^^^|message to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

using emailed Corsi asking him to “send me your best podesta links.” 

STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12,2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

with 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13,2016, CORSI emailed STONE at 

“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “Til give you one more — NOBODY YET HAS THIS[:] It looks to me 
like skimmed maybe billions off Skolkovo — Skolkovo kept their money with 

Metcombank[.] The Russians launched a criminal investigation^] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[,] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at^^^^^^^^^^^^vith the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by ^^^^^^^vith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17,2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u—just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

ASSANGE...URGENT.CORSI wrote, “From a very trusted source,” and forwarded an email 


with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand offf.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19,2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9,2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 

account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “Pm in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21,2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21,2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12,2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26,2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That- 

Q: - was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Band Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [MJy tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19,2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[,]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27,2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29,2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12,2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify) .]” 

98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 

4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13,2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6,2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8,2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence^] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13,2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary. 

,. When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9,2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

Statements Regarding STONE’s Use of Social Media 

105. On or about Friday, May 18,2018, voluntarily interviewed 

by investigators from the Special Counsel’s Office.^^^^^^^old investigators that he became 
STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’s 
right-hand man. 

106. According to^^^^^STONE utilized the services of several individuals to 
post social media content to Facebook and Twitter, and that he ^^^^^^Jand STONE both 
instructed these individuals about what to post, ^^^^^^^tated that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 
and that bloggers working for STONE would try to build what looked like real Facebook 
accounts. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 

threatened-dog-135911370.html 

6 https://www.motheijones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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107. further stated that STONE wanted to push out WikiLeaks content 
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 
was pushed out through STONE’s Facebook and Twitter accounts. 

108. In or around August 2018, pursuant to a warrant issued by Chief Judge Howell, 

the FBI searched several Facebook accounts associated with STONE, which (among other 
things) were used to purchase Facebook advertisements. Search warrant returns for one of those 
accounts show that STONE or one of his associates created an ad 

campaign on or about August 26,2016, that included the text, “The Democrats are right to fear 
Assange’s next email drops will be devastating to Hillary.” The same account was also used to 
create and run a Facebook ad campaign on or about March 28,2017, that included the following 
text: “ROGER STONE - NO consensus that Guccifer 2.0 is a ‘Russian Asset’ just because US 
Intel says he is.” 

L. The Target Account 

109. According to subscriber records, Target Account 

created on August 17,2015, in the name of “Falo Memo Tio.” 7 STONE’s ^^^^Jaccount 

listed as the recovery email for the Target Account. In my training and 
experience, when setting up a new email account, users typically provide an email account imder 
their control as the recovery account in order to ensure continued access to the new account, for 
example, in the event a password is lost or compromised. 

7 Subscriber records list the “Language Code” for the Target Account as “pt_BR.” I believe 
this indicates that the subscriber selected Brazilian Portuguese as the primary language for the 
account. Based on machine translation, the customer name “Falo Memo Tio” translates from 
Portuguese to “I speak Memo Uncle.” 
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110. The government obtained non-content information associated with the Target 
Account pursuant to an order issued by Chief Judge Howell under 18 U.S.C. § 2703(d). 

Although subscriber records indicate that the last login to the Target Account took place on 
August 18, 2015, header information shows that the account continued to receive emails until at 
least July 27,2018, including from companies that offer advertisement placements. 

111. Header information shows that the Target Account received multiple emails 
from Facebook between approximately November 3,2016 and November 7, 2016, shortly before 
the U.S. presidential election. On or about October 5, 2016, the Target Account also received 
an email from adsense-noreply@google.com, an account that I believe is associated with Google 
AdSense. According to open source information, Google AdSense is a program that matches ads 
to websites based on their content and visitors, and it allows individuals to place targeted 
advertising on its network of content sites. 

BACKGROUND CONCERNING GOOGLE 

112. In my training and experience, I have learned that Google provides a variety of on¬ 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 
application information. In my training and experience, such information may constitute evidence 
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of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

113. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

114. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

115. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
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technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

116. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

117. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
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the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

FILTER REVIEW PROCEDURES 

118. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

119. Based on the forgoing, I request that the Court issue the proposed search warrant. 

120. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 

121. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 


known to all of the targets of the investigation. Accordingly, there is good cause to seal these 


documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 



C(jrtis-Heide 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 9/6_ day of August, 2018. 

I 


es E. Boasberg 


The'Hoporab 
I^nited^StateiTDistrict Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California: 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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f. 

g- 

h. 

i. 

j- 

k. 

l . 

m. 

n. 

o. 

P- 

q- 

r. 

s. 

t. 


All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

All subscriber “change history” associated with the account; 

All search history and web history associated with the account; 

All location and maps information associated with the account; 

AH Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 
All Google Developers Console information associated with the account; 

All Minutemaid information associated with the account; 

All Android information associated with the account; 

All Google Docs associated with the account; 

All YouTube information associated with the account; 

All Google Hangouts information associated with the account; 

All Google Voice information associated with the account; 

All Web & App Activity associated with the account; 

All Google Drive information associated with the account; 

All Google+ information associated with the account; 

All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MS ISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1,2015 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy or any 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) 

STORED AT PREMISES ) 

CONTROLLED BY 1&1 MAIL & MEDIA, INC. ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Eastern _ District of Pennsylvania 

(identify the person or describe the property to be searched and give its location) \ 


Case: 1:18-sc-02729 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before September 11,2018 ( no t to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge . 


(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for days (not to exceed 30) □ until, the facts iustifv 


Date and time issued: 

City and state: Washington, DC_ 



j 


\tture 


Hon. JdraeS E. Boasberg, U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following l&l Mail accounts, 
which are stored at premises owned, maintained, controlled, or operated by l&l Mail & Media, 
Inc. (“l&l Mail”), a company headquartered in Chesterbrook, Pennsylvania: 
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ATTACHMENT B 

I. Information to be disclosed by l&l Mail 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of l&l Mail & Media, Inc. (“l&l Mail”), including any messages, records, 
files, logs, or information that have been deleted but are still available to l&l Mail, or have been 
preserved pursuant to a request made under 18 U.S.C. § 2703(f), l&l Mail is required to disclose 
the following information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other infonnation regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web histoiy associated with the account; 

h. All location and maps information associated with the account; 

i. All device information associated with the account, including all instrument or 

telephone numbers (including MAC addresses. Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 

j. For any accounts l ink ed to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 
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II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1, 2015 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy or any 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 
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e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
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to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection ILa. 
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United States District Court 


for the 

District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and addressj 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY1&1 MAIL & MEDIA, INC. 


Clerk, U.S. District & Bankruptcy 
Courts tor the District of Columbia 


Case: 1:18-sc-02729 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the _ Eastern _District of 

person or describe the property to be seized)'. 

See Attachment B 


Pennsylvania 


, there is now concealed (identify the 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
ivf evidence of a crime; 

fif contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001,1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


iyf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: _ 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: 
Kyle R. Freeny (ASC) 


Sworn to before me and signed in my presence. 


—^ Applicant’s signature 

_ Curtis Heide, Special Agent, FBI 

Printed name and title 



City and state: Washington, D.C. 


/ Judge ’sjjgrmture 

Hon. Boasber^ U.S. District Judge 

Printed name and title 
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IN THE UNITED STATES DISTRICT COURT AUG 2 8 2018 

FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy 

Courts for ttte District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY l&l MAIL & MEDIA, 
INC. 


Case: 1:18-sc-02729 

Assigned To : Chief Judge Beryl A. Howell 

Assign. Date: 8/28/2018 

Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Curtis Heide, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with the l&l Mail account (“Target Account”), 
stored at premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. (“l&l 
Mail”), a company headquartered in Chesterbrook, Pennsylvania. The information to be disclosed 
by l&l Mail and searched by the government is described in the following paragraphs and in 
Attachments A and B. 

2. I have been a Special Agent with the Federal Bureau of investigation for 12 years. 
In the course of my duties, I have been responsible for investigating federal crimes and national 
security matters involving both counterintelligence and issues related to cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and i n formation obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
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instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A, Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
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STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 






Case l:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 13 of 48 



B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 
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12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1,2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own'.technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4,2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, etal. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14,2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5,2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8,2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12,2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17,2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Tramp Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. //CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, 1 think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStone Jr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7,2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
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33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I kn ew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
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account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4,2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


1 On or about August 7,2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE,Others Regarding 
Forthcoming Leaks 

41. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for STONE’s^^^^|address,^^^^^^^^^^^^^| On October 

17, 2017, Chief Judge Howell issued a search warrant for one of STONE’s ^^^^addresses, 

On or about December 19,2017, Chief Judge Howell issued a search 
warrant for ^^^^^^^^email account. On or about March 14,2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 2016,emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now...CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 
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43. On or about May 18,2016, CORSI emailed STONE at 

with the title, “Roger -- why don't you look this over before I send believe that 

fi CORSI wrote, 

I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, using^^^^^^^^^^^sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, using emailed 

CORSI with the subject line, “Call me MON.” The body of the email read: ^^^^^should see 
Assange[.] ^^^Jshould find Bemie [Sjanders brother who called Bill a Rapist - turn him for 
Trump[.] ^^^^^hould find or more proof of Bill getting kicked out.” 

46. On or about August 2,2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

“Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke - 
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neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSPs reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5, 2016, associate of STONE’s, emailed 

STONE at The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ^^^^^|subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE. ^^^^^^|also stated 
that in 2018,^^^^^^:oid STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told was joking and 

had not actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to^^^^J to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this aftemoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
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STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 

“Give me a today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 


50. On or about August 31,2016, CORSI emailed STONE at 
“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or.about August 31,2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6,2016, CORSI emailed STONE at 
“Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016,emailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” wrote back, “Awaiting secret file. Explosive... Hope you are well. 

Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, indicated this 

conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 

asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 


back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 


55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 


not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE ‘What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer is a bi § 

democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14,2018, he initially denied knowing whether the October 4,2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7,2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

at approximately 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 



3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-lle6-875e-2clbfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 

‘I expect 

that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM, an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 

with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 

newly-released Podesta emails. Approximately ten minutes later, STONE, using 

^^^^^^^^^^^^^orwarded ^^^^^^message to CORSI STONE 

does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 

67. On or about October 8,2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

emailed Corsi asking him to “send me your best podesta links.” 

STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 



On or about August 2, 2016, CORSI emailed STONE using 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3 :25PM EDT, CORSI 

STONE at both the 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13,2016, CORSI emailed STONE at 

“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “Ell give you one more — NOBODY YET HAS THIS[:] It looks to me 
like skimmed maybe billions off Skolkovo — Skolkovo kept their money with 

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once^^^^H 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13,2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at ^^^^^^^^^^^Jwith the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,j You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by ^^^^^Jwith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[,]” STONE responded, “Missed u - just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

the 

ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them it 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Tramp speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “1 predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none ol them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21,2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12,2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published exceipts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
co mmuni cation with Assange or communication through an intennediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That¬ 
ch: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtmth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24,2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28,2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27,2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29,2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’... Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-chamiel and you could have just told the truth ... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back ... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 

4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13,2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6,2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8,2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25,2018, CREDICO wrote to STONE: “You lied to the house Intel committee... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence [.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25,2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

K. Stone’s Use of the Target Account 

According to subscriber records, Target Account was 

created on November 4, 2015 in the name of Roger Stone, and the last login to the account was 
May 29,2018. 7 

106. Based on communications identified through a court-authorized search of 

STONE’s Gmail account I have learned that STONE used Target 

Account to send and receive communications about WikiLeaks and 

Assange: 

107. For example, on or about March 21, 2018, STONE used the Target Account to 
send an email with the subject, “Randy [Credico] and Me: The Truth about WikiLeaks.” The 

5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 

threatened-dog-135911370.html 

6 https ://www.motherj ones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 

7 The customer date of birth listed in the subscriber records is not STONE’s birthdate. In my 
training and experience, providers such as l&l Mail do not verify customer dates of birth. 
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email appears to be a media blast sent to a distribution list that included STONE’s Gmail account 

In the email, STONE claimed, in substance and in part, that in 2016 he 
had asked Credico to confirm that Assange had credible information on Clinton, and that Credico 
“never said from whom he gained [the] confinnation, or the source, or the content of whatever 
was coming.” 

108. At least one reporter also emailed STONE at the Target Account about 
WikiLeaks and Assange. In particular, on or about May 11,201 8 , a reporter with the 

nd Target Account 

rogerstone@mail.com about “a story on the Mueller investigation.” The reporter described “a 
scene when says he was asked about an email he received 

from [STONE] that made reference to an upcoming meeting with Julian Assange.” After noting 
- STONE’s position that no meeting with Assange ever occurred, the reporter also asked STONE, 
in substance and in part, if he had anything further to add to the story. 

109. On or about the same day, STONE responded from his Google account 
stating that the email concerning a meeting with Assange was “a joke 

made while trying to get^^Jrff the phone.” STONE also wrote, “Now would be a good time 
for the Washington Post to report that the accusation there was an email that proved that I knew 
about the contents of the WikiLeaks disclosures in advance has never been seen by the 
Washington Post and was then ascribed to a ‘phone call.’” 

BACKGROUND CONCERNING l&l MAIL 

110. In my training and experience, I have learned that l&l Mail provides a variety of 
on-line services, including electronic mail (“email”) access, to the public, l&l Mail allows 
subscribers to obtain email accounts at several domain names, including mail.com, like the Target 



Washington Post emailed STONE at both 
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Account. Subscribers obtain an account by registering with l&l Mail. During the registration 
process, l&l Mail asks subscribers to provide basic personal information. Therefore, the 
computers of l&l Mail are likely to contain stored electronic communications (including retrieved 
and unretrieved email for l&l Mail subscribers and information concerning subscribers and their 
use of l&l Mail services, such as account access information, email transaction information, and 
account application information. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

111. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

112. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i. e ., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
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account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

113. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of Contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

114. This application seeks a warrant to search all responsive records and information 
under the control of l&l Mail, a provider subject to the jurisdiction of this court, regardless of 
where l&l Mail has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic communications 
and any records or other information pertaining to the customers or subscribers if such 
communication, record, or other information is within l&l Mail’s possession, custody, or control, 
regardless of whether such communication, record, or other information is stored, held, or 
maintained outside the United States. 

115. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
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under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location intonnation 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime ( e.g ., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

FILTER REVIEW PROCEDURES 

116. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
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with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

117. Based on the forgoing, I request that the Court issue the proposed search warrant. 

118. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

119. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 



Special Agent 

Federal Bureau of Investigation 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following l&l Mail accounts, 
which are stored at premises owned, maintained, controlled, or operated by l&l Mail & Media, 
Inc. (“l&l Mail”), a company headquartered in Chesterbrook, Pennsylvania: 
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ATTACHMENT B 

I. Information to be disclosed by l&l Mail 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of l&l Mail & Media, Inc. (“l&l Mail”), including any messages, records, 
files, logs, or information that have been deleted but are still available to l&l Mail, or have been 
preserved pursuant to a request made under 18 U.S.C. § 2703(f), l&l Mail is required to disclose 
the following information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All device information associated with the account, including all instrument or 

telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MELD”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMS1”), or 
International Mobile Equipment Identities (“IMEI”)); and 

j. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 
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II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1, 2015 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange. 

individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 
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e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user ’ s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
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to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

) Case: 1:18-sc-02881 

) Assigned To : Howell, Beryl A 

) Assign. Date : 9/24/2018 

) Description: Search & Seizure Warrant 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Western _ District of _ Michigan 

(identify the person or describe the property to be searched and give its location)'. 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE VIRTUAL PRIVATE SERVER 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _ October 8, 2018 _ ( no t to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge . 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

I - ) for_days (not to exceed 30) □ until, the facts justifying, the later specific date of _. 

Date and time issued: / ty/P _ 

Judge’s signature 

City and state: Washington, DC _ Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to the virtual private server using the IP address set forth below, which 
is controlled and/or operated by Liquid Web, LLC, a company headquartered in Lansing, 
Michigan: 
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ATTACHMENT B 
I. Information to be disclosed by Liquid Web LLC 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Liquid Web LLC (hereinafter, “the Provider”), regardless of where such 
information is stored, held or maintained, the Provider is required to disclose the following 
information to the government for the server listed in Attachment A (“Target Server”): 

a. A forensic copy of the contents of the Target Server described in Attachment A; 
information pertaining to the tool and process used to create said forensic copy; a 
log of the process; verification of the process; a record of who created the copy, 
when it was created, and where it was created, including the person’s name, title, 
contact numbers, and address; 

b. A forensic copy of the undisturbed contents of random access memory of the 
running Target Server described in Attachment A; information pertaining to the tool 
and process used to create said forensic copy; a log of the process; verification of 
the process; a record of who created the copy, when it was created, and where it 
was created, including the person’s name, title, contact numbers, and address; 

c. All records of other subscriber information regarding the account, to include ufll 
name, physical address, telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of 
service, the types of services utilized, the IP address used to register the account, 
login-in IP addresses associated with session times and dates, account status, 
alternative email addresses provided during registration, methods of connection, 


-2- 



Case l:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 5 of 56 


log files, and means and source of payment (including any credit or bank account 
numbers); 

d. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1,2015 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy any 
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individual associated with the Trump Campaign, or any witness in the 
investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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FILED 

24 2018 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 


Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
VIRTUAL PRIVATE SERVER 


Case: 1:18-sc-02881 
Assigned To : Howell, Beryl A 

Assign. Date : 9/24/2018 

Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Liquid Web, LLC (“Liquid Web”), an electronic communication and/or remote 
computing services provider headquartered in Lansing, Michigan, not to disclose the existence or 
contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Liquid Web and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Liquid Web for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 



Date 




/*■ 
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THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 
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PS I 

United States District Court 


for the 


•SEE l h 



District of Columbia 


Clark, U.£». District & Bankruptcy 
Courts foi the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE VIRTUAL PRIVATE SERVER 


) 

) 

) 

) 

) 

) 


Case: 1:18-sc-02881 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/24/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the_ Weste rn _District of_ Michigan _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

Iff evidence of a crime; 

ivf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
|Kyle R. Freeny (ASC) 



Applicant's signature 

Patrick J. Myers, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 

Date: f/4 

Judge's signature 

City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP H 2018 

Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE VIRTUAL PRIVATE SERVER 


Case: 1:18-sc-02881 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/24/2018 
Description: Search & Seizure Warrant 


AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant under 18 

U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A). The search warrant seeks authorization to 
search a private server (“Target Server”) controlled and operated by Liquid Web, LLC, a 
company with headquarters in Lansing, Michigan. The virtual private server (“VPS”) to be 
searched, with Internet Protocol (“IP”) address believed to be used by Roger 

STONE and is described further below and in Attachment A. Upon receipt of the information 
described in Attachment A, government-authorized persons will review that information to locate 
the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 


approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 


3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Server contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 


Election 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 
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18. On July 13, 2018, a grand juiy in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United Slates v. Viktor Borisovich Nelyksho, el al. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13,2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. //WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Info wars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctY’ me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

3 8. On or about November 9,2016, one day after the presidential election, 

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStone Jr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSPs Communications with STONE,^^^^^^^|and Others Regarding 
Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for STONE’S address^^^^^^Dn October 

17,2017, Chief Judge Howell issued a search warrant for one of STONE’s ^^Jaddresses, 

'ji; , • V®n or about December 19, 2017, Chief Judge Howell issued a search 

warrant for email account. On or about March 14, 2018, Chief Judge Howell 

issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 201led CORSI: “Here is my flight 
schedule. Need to get something confirmed now....” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
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appears to have forwarded the message to STONE replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 


43. On or about May 18, 2016, CORSI emailed STONE at| 
with the title, “Roger — why don't you look this over before I send it tel 


I believe that 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5, 201associate of STONE’s, emailed 

STONE at The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ^^^^^^^ubsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE.^H^^^|also stated 
that in 2018^^^^^^^told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told^^^^^^|he was joking and 
had not actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email tc^^^^^^^^to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this aftemoonf.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
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call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 
“Give me a call today if you can. Despite MSM drumroll that HRC is 

already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 
“Did you get the PODESTA writeup.” STONE replied “[y]es.” 




51. On or about August 31,2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
‘Rogerf,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016,^^^^^^^emailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.’^^^^^^|wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators,^^^^^^|indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 

and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4,2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer is a big 

democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging infonnation that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

to phone records^^^^^^^^^^^^^^^^^| at 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


3 https://www.washingtonpost.com/Ufestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-lle6-875e-2clbfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using^^^^^^^^^^^^J “1 expect 
that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM,an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forwarded^^^^Jmessage to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using^^^^^^^^^^^Jemailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

r ith the subject 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 

talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Account, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 

CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like skimmed maybe billions off Skolkovo — Skolkovo kept their money with 

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 



emailed STONE at boll 



- 18 - 






Case l:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 29 of 56 


Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at^^^^^^^^^^^^^^vith the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by ^^^^^Jwith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

with the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.J I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18,2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19,2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 



- 20 - 



Case l:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 31 of 56 


80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21,2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the tuning, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21,2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1,2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Chamiel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 

... you should go back ... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
peijury if you’re stupid enough to testify[.]” 

98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 

4 Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testily before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8,2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 

stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 

considered this email from STONE a threat. STONE stated in the article that CREDICO “told 

me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 

have prostate cancer and did not have any such discussion with STONE. 

K. The Target Server and STONE’s Efforts to Remove Documents and Information 
from his Residence 

105. On or about Friday, May 18,2016.^^^^^^^^|an assistant to STONE, was 
voluntarily interviewed by investigators from the Special Counsel’s Office, ^^^^^^^old 
investigators that he became STONE’s assistant in Florida in 2015, and that during the summer 
of 2016, he acted as STONE’s right-hand man. ^^^^^^^old investigators, in substance and 
in part, that STONE was scared about getting hacked and scared about the government 
“snooping” on him, and that STONE was in the process of hardening his home systems and 
trying to move things off his desktop computer to a secure server.^^^^^^|further advised 
that STONE had a new “tech guy” assisting him. 

106. ^^^^^^^old the FBI that as part of this process, STONE was encrypting his 
data but not deleting it. Analysis of STONE’s iCloud, which was searched pursuant to a warrant 

5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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issued by Chief Judge Howell on or about August 3, 2018, nonetheless indicates that call logs 
and chats occurring prior to March 1, 2018 have been deleted. Call logs and/or chats from 
certain additional periods of time (for example, June 29, 2018 to July 13, 2018) also appear to 
have been deleted. To date, the FBI has not been able to determine when those deletions 
occurred. 

107. On or about May 22, 2018who provided tech services for 

STONE’s iMacs, was voluntarily interviewed by the FBI by telephone (having previously been 
interviewed in person). stated that STONE’s wife had hired someone else to set up an 

offsite remote server for data at their Fort Lauderdale residence. identified the individual 

who set up the server as Freestyle Systems, whom^^^Jnet in person at 

STONE’s house in early April. indicated that STONE was concerned with his business 

and work if his computers were seized and he did not have access to them, and he wanted to be 
able to continue to work, write, and get the word out in that event. stated that he believed 

that the remote server is hosted by Liquid Web and that STONE pays approximately $500 per 
month for it. 

108. Based on open source information, I know that Liquid Web, LLC is a U.S. 
provider offering dedicated servers, VPS hosting, and cloud servers with Linux or Windows. 



Web for an account opened b 


|the government obtained subscriber records from Liquid 



'hose records show that on or about March 27, 2018, 


-*|jpj§9 purchased a server described as “Item: DS.1230v5 - Dedicated Server - Single Intel Xeon 
CPU - US Central Zone” for $324 per month (“Target Server”). On or about the same day, a 
new inventory entry was made in the Liquid Web system, reading “New entry in inventory 
[223605:2869647]: description: <b>host.rogerstone.com::DS.1230v5</b>, owner rel id: 
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<b>3475479</b>.” In my training and experience, this indicates that the server purchased by 
IjSlSwas namedAccording to public WHOIS records, the domain 
is registered to Roger Stone, 

109. According to records obtained from Liquid Web, the name of the Target Server 

was changed or about March 28, 2018. The Target Server was 

assigned the IP address^^^^^^^f Based on a search conducted on shodan.io, a specialized 
search engine that scans information about all devices connected to the Internet, the Target 
Server’s configuration has not been changed since March 28, 2018. 

110. According to communications produced by 

on or about March 27, 2018-—the same day that first leased the Target 

Server—STONE’s wife texte<^^^^^ Would you be willing to speak to who has 

setting [sic] up a hosted server for Rogers computer? ... .All of Rogers data is still on his 
desktop but because of his issues with government agencies and after a total backup of his 
system and a forensic audit of all the emails and documents on his computer it was concluded 
that all future information would be safer on an outside server....” 

111. On or about April 9, 2018 ^^^^^^Jsent STONE an email at 

'I "" ~’ m n , '" M l i T yvith the subject, “Remote server update.” In that email,^^^^^^stated, 
“After finding out he couldn’t wipe the data from your drives -^^^^^^^^new IT guy) 
wanted us to buy new hard drives and replace the drives on your iMac (and have [Stone’s 
attorney] put them away in safety deposit box).” ^^^^^^^iso told STONE that, if the data 
was migrated onto a server that runs Windows (which the Target Server does), “[b]oth 
iMacs ... would need to be put somewhere out of the house/apt to accomplish ‘getting data out 
of the house.’” 
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112. April 9, 2018 email suggests that, at the time^^^^^^^^id not 
understand that^^^^had already stood up a server for STONE. In substance ^^^^ ^"!j^j 
recommended against the use of a remote Windows server, and asked STONE to “[l]et me know 
if you want to stay put, or go to windows server witf^^|^^| 

113. According to communications provided by^^^^o the FBI, on or about April 

25, 2018, “I just got a call from^^^| and it appears Roger is going 

forward with the server idea.” When^^^^^Jasked ^^J“[w]hat exactly”^^^Jwas 
doing,^^^J:eplied, “Synchronizing the files to the server ... 

114. Based on the foregoing, and my training and experience, there is probable to 
cause to believe that the Liquid Web remote server with IP addrcs^^^^^^^| /. e ., the Target 
Server, is a dedicated server used by, and set up on behalf of, STONE, and that the Target 
Server contains evidence, fruits, and/or instrumentalities of the Subject Offenses. 

BACKGROUND CONCERNING LIQUID WEB 

115. Based on open source i nf or ma tion, I know that Liquid Web, LLC, which hosts the 
Target Server, is a company based in Lansing, Michigan, which offers dedicated servers, VPS 
hosting, and cloud servers with Linux or Windows. The Target Server is among a number of 
VPSs running on physical servers controlled by Liquid Web. According to public WHOIS data, 
the Target Server is located in Lansing, Michigan. 

116. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been downloaded 
onto a storage medium, deleted, or viewed via the Internet. Electronic files downloaded to a 
storage medium can be stored for years at little or no cost. Even when files have been deleted, 
they can be recovered months or years later using forensic tools. This is so because when a person 
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“deletes” a file on a computer, the data contained in the file does not actually disappear; rather, 
that data remains on the storage medium until it is overwritten by new data. 

117. Therefore deleted files, or remnants of deleted files, may reside in free space or 
slack space - that is, in space on the storage medium that is not currently being used by an active 
file -for long periods of time before they are overwritten. In addition, a computer’s operating 
system may also keep a record of deleted data in a “swap” or “recovery” file. 

118. Wholly apart from user-generated files, computer storage media contain electronic 
evidence of how a computer has been used, what it has been used for, and who has used it. To 
give a few examples, this forensic evidence can take the form of operating system configurations, 
artifacts from operating system or application operation, file system data structures, and virtual 
memoiy “swap” or paging files. Computer users typically do not erase or delete this evidence, 
because special software is typically required for that task. However, it is technically possible to 
delete this information. 

119. Similarly, files that have been viewed via the Internet are sometimes automatically 
downloaded into a temporary Internet directory or “cache.” The browser often maintains a fixed 
amount of hard drive space devoted to these files, and the files are only overwritten as they are 
replaced with more recently viewed Internet pages or if a user takes steps to delete them. 

120. As further described in Attachment B, this application seeks permission to locate 
not only the computer files that might serve as fruits and instrumentalities or the crimes described 
in the warrant, but also for evidence, also described in Attachment B, that established how 
computers were used, the purpose of their use, who used them, and when. 

121. Data on the storage medium not currently associated with any file can provide 
evidence of a file that was once on the storage medium but has since been deleted or edited, or of 
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a deleted portion of a file (such as a paragraph that has been deleted from a word processing file). 
Virtual memory paging systems can leave traces of information on the storage medium that show 
what tasks and processes were recently active. Web browsers, email programs, and chat programs 
store configuration information on the storage medium that can reveal information such as online 
nicknames and passwords. Operating systems can record additional infonnation, such as the times 
the computer was in use. Computer file systems can record information about the dates files were 
created and sequence in which they were created. 

122. Forensic evidence on a computer can also indicate who has used or controlled the 
computer. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, registry information, configuration 
files, user profiles, email, email address books, “chat,” instant messaging logs, photographs, and 
correspondence (and the data associated with the foregoing, such as file creation and last accessed 
dates) may be evidence of who used or controlled the computer at a relevant time. 

123. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about how computers 
were used, the purpose of their use, who used them, and when. 

124. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an accurate conclusion 
is a dynamic process. While it is possible to specify in advance with particularity a description of 
the records sought, evidence of this type is not always data that can be merely reviewed by a review 
team and passed along to investigators. Whether data stored on a computer is evidence may 
depend on other information stored on the computer and the application of knowledge about how 
a computer behaves. 
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125. The FBI anticipates executing this warrant under the above-cited ECPA provisions 
by using the search warrant to compel Liquid Web to provide a copy of the Target Server, 
including a copy of the memory used by the Target Server. Generally speaking, this copy 
duplicates every bit and byte on the Target Server, including all files, slack space, Master File 
Table, and metadata in exactly the order they appear on the original; in order words, Ihe taking of 
a complete electronic picture of the computer’s data, including all hidden sectors deleted files, and 
memoiy. In my training and experience, the data associated with the Target Server, including 
artifacts such as slack space and deleted files, are segregated as part of the Target Server and can 
be imaged separately from other VPSs that may be stored on the same physical server. After 
obtaining a copy of the Target Server, FBI agents or their experts will review that information to 
locate the items described in Section II of Attachment B. 

126. This application seeks a warrant to search all responsive records and information 
under the control of Liquid Web, a provider subject to the jurisdiction of the Court, regardless of 
where Liquid Web has chosen to store such information. The government intends to require, 
pursuant to the warrant, the disclosure of the contents of wire or electronic communications and 
any records of other information pertaining to the customers or subscribers if such communication, 
records, or other information is within Liquid Web’s possession, custody, or control, regardless of 
where that information is stored. 

127. As noted above,told the FBI that, in connection with STONE’s efforts 
to move material off his desktop to a secure server, STONE was encrypting data. Accordingly, it 
is possible that paid or all of the data on the Target Server is encrypted. In my training and 
experience, I know that if the FBI obtains a forensic copy of the undisturbed contents of random 
access memory of the running Target Server, which is sought in this application, it may be 
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possible to carve data to locate the encryption password. If this application is granted and the 
server is, in fact, encrypted, the FBI intends to use that process to locate the password through 
forensic means, and to use the password to access the server in execution of the warrant. 

FILTER REVIEW PROCEDURES 

128. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a mamier consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

129. Based on the forgoing, I request that the Court issue the proposed search warrant. 

130. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


131. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 


Subscribed and sworn to before me on this 



Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 


A 


day of September, 2018. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to the virtual private server using the IP address set forth below, which 
is controlled and/or operated by Liquid Web, LLC, a company headquartered in Lansing, 
Michigan: 
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Case l:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 48 of 56 

ATTACHMENT B 
I. Information to be disclosed by Liquid Web LLC 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Liquid Web LLC (hereinafter, “the Provider”), regardless of where such 
information is stored, held or maintained, the Provider is required to disclose the following 
information to the government for the server listed in Attachment A (“Target Server”): 

a. A forensic copy of the contents of the Target Server described in Attachment A; 
information pertaining to the tool and process used to create said forensic copy; a 
log of the process; verification of the process; a record of who created the copy, 
when it was created, and where it was created, including the person’s name, title, 
contact numbers, and address; 

b. A forensic copy of the undisturbed contents of random access memory of the 
running Target Server described in Attachment A; information pertaining to the tool 
and process used to create said forensic copy; a log of the process; verification of 
the process; a record of who created the copy, when it was created, and where it 
was created, including the person’s name, title, contact numbers, and address; 

c. All records of other subscriber information regarding the account, to include ufll 
name, physical address, telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of 
service, the types of services utilized, the IP address used to register the account, 
login-in IP addresses associated with session times and dates, account status, 
alternative email addresses provided during registration, methods of connection, 
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log files, and means and source of payment (including any credit or bank account 
numbers); 

d. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1, 2015 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy 
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individual associated with the Trump Campaign, or any witness in the 
investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT O^ TTUDIA 

Case: 1:18-sc-02881 
( Assigned To : Howell, Beryl A. 

Assign. Date : 9/24/2018 
- Description. Search & Seizure Warrant 

MOTION TO SE AL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(V)~ 

The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Liquid Web, LLC (“Liquid Web”), an electronic 
communication and/or remote computing services provider headquartered in Lansing, Michigan, 
not to notify any other person (except attorneys for Liquid Web for the purpose of receiving legal 
advice) of the existence or content of the Warrant for a period of one year or until further order of 
the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard , 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
VIRTUAL PRIVATE SERVER 
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“district court of the United States ... that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 271 l(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Liquid Web provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Liquid Web may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts \sic\ finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Liquid Web not to notify any other person (except attorneys for Liquid Web for the 
purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until 
further order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 

Offenses”), in connection with efforts to compromise the networks of the Democratic National 

3 
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Convention (“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the 
email accounts of U.S. persons involved in the 2016 presidential election, followed by the public 
release of stolen materials through various outlets. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Liquid Web and its employees be directed not to notify any other person of 
the existence or content of the Warrant (except attorneys for Liquid Web for the purpose of 
receiving legal advice) for a period of one year or until further order of the Court. Such an order 
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and 
nature of which is neither public nor known to the targets of the investigation, and its disclosure 
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of 
the Warrant and related papers may also alert the targets to the scope of information known to the 
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy 
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and 
otherwise take steps to undermine the investigation and avoid future prosecution. In particular, 
given that they are known to use electronic communication and remote computing services, the 
potential target could quickly and easily destroy or encrypt digital evidence relating to their 
criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

4 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Liquid Web, the United States is aware that, absent a 
court order under Section 2705(b) commanding Liquid Web not to notify anyone about a legal 
request, Liquid Web may, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Liquid Web not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for Liquid Web for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 


Dated: °)/Z*\A % 


Respectfully submitted, 
ROBERT S. MUELLER, III 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

Case: 1:18-sc-02905 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Nor thern _ District of _ California 

(identify the person or describe the property to be searched and give its location) \ 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY TWITTER 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 9, 2018 ( no t to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howell, C hief U.S. Dis trict Judge 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of_ _. 


Date and time issued: 





City and state: Washington, DC 



Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 
company headquartered in San Francisco, California: 
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ATTACHMENT B 


I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Twitter, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 
information to the government for each account listed in Attachment A: 

A. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 

B. The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 

C. All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 

D. All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 

E. All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 

F. All photographs and images in the user gallery for the account; 

G. All location data associated with the account, including all information collected by the 

“Tweet With Location” service; 

H. All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 

I. All data and information that has been deleted by the user; 

J. A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 

K. A list of all users that the account has “unfollowed” or blocked; 

L. All “lists” created by the account; 
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M. All information on the “Who to Follow” list for the account; 

N. All privacy and account settings; 

O. All records of Twitter searches performed by the account, including all past searches saved 
by the account; 

P. All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 

Q. All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 

R. All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 

S. All data and information associated with the profile page, including photographs; 

T. All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 

U. The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 

V. All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 

W. Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 

X. All activity logs for the account; 

Y. All location information for the account, including all location data collected by any 
plugins or widgets; 

Z. The types of service utilized by the user; 
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AA. All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 

BB. All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 

CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 

DD. All data and information that has been deleted by the user; 

EE. The length of service (including start date) and the means and source of any payments 

associated with the service (including any credit card or bank account number); 

FF. All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 

GG. Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 

HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 

II. All records pertaining to communications between the Service Provider and any person 

regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi,^^^^^^^^^^| Julian 

Randy any 

individual associated with the Trump Campaign, or any witness in the 
investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II.a. 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 

District of Columbia 



SEP 1 6 2018 


In the Matter of the Search of ^ 

(Briefly describe the property to be searched ) 

or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED j 
BY TWITTER { 


Case: 1:18-sc-02905 
Assigned To : Howell, Beryl 
Assign. Date : 9/26/2018 

^ --.■ x:_ 


f lerk US. District & Bankruptcy 
Courts for the district of Columbia 


A. 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Northern _ District of_ California _ , there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 

(?f contraband, fruits of crime, or other items illegally possessed; 

&( property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


Eyf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
Kyle R. Freeny (ASC) 



Applicant's signature 


Patrick J. Myers, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 



City and state: Washin gton, D .C. 



Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 2 6 2018 


Cleik, U.S. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY TWITTER, INC. 


Case: 1:18-sc-02905 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 
Description. Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for 

the account^^^^^^^^^^^^^^^^^^^^^^ which 

stored at premises owned, maintained, controlled or operated by Twitter, Inc. (“Twitter”), a 

Upon receipt of the information described in Attachment A, government-authorized persons will 
review that information to locate the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter’ 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Nelyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. 1 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJr, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHiIlary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7,2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJ Stone Jr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JuIianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JuIianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE,and Others Regarding 

Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for STONE’ address,October 

17, 2017, Chief Judge Howell issued a search warrant for one of STONE’s^^^Haddresses, 

BMMBBBMHft iBWOn or about December 19, 2017, Chief Judge Howell issued a search 
warrant for^^^^^^^Hemail account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 2016,emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now_” CORSI responded, “1 copied Roger 

Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
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appears to have forwarded the message to STONE replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18, 2016, CORSI emailed STONE 
with the title, “Roger — why don't you look this over before I send it believe that 
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call later-heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 

me a today you Despite MSM drumroll 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 

you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
|^^^^^^^^^^^^^|‘Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 20l6,^^^^^^|emailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.”^^^^^^Jwrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators^^^^^^Jindicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 
and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE at^^^^^^^^^^^^|“What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don't think so BUT his lawyer is a big 

democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

to phone records at 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 Id74714-8ce5-l le6-875e-2clbfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE “I expect 

that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM^^^^^^^^^ an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forvvardec^^^^^l message to CORSI without comment. STONE 

does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

usiled Corsi asking him to “send me your best podesta links.” 

STOM^^m^^^^^^^^pproximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

bothj^^^^^^^^^^^^J with the 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the^^^^| Account, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
‘PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 

CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like^^^^^J skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombankf] The Russians launched a criminal investigation!?] [web link] Once^^^^l^ 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 



-18- 







Case l:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 29 of 59 


Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,J You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent with the money 

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

with the subject, “Fwd: 

wrote, “Prom a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.j I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.J’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no'advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORS1 messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19,2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stufff.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British 1TV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . .. Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 

... you should go back ... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 

4 Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSC1 and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. The Target Account 



5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-13 5911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING TWITTER 

110. Twitter owns and operates a free-access social-networking website of the same 
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
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profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users create and read 140-character messages called “Tweets,” 
and to restrict their “Tweets” to individuals whom they approve. These features are described in 
more detail below. 

111. Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

112. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

113. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her 
account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

114. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 
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115. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 
account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

116. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

117. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

118. When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

119. A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
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visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

120. In addition to posting Tweets, a Twitter user can also send Direct Messages 
(DMs) to one of his or her followers. These messages are typically visible only to the sender and 
the recipient, and both the sender and the recipient have the power to delete the message from the 
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a 
particular user, but older DMs are stored on Twitter’s database. 

121. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

122. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 
25 past searches. 

123. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 

124. If a Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 
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125. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

126. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter account activity can show how and when the account was accessed or 
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
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Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

127. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other account 
information. 

FILTER REVIEW PROCEDURES 

128. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

129. Based on the forgoing, I request that the Court issue the proposed search warrant. 

130. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


131. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 


Subscribed and sworn to before me on this 


^Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 


tf^^day of September, 2018. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 
company headquartered in San Francisco, California: 
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ATTACHMENT B 


I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Twitter, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 
information to the government for each account listed in Attachment A: 

A. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 

B. The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 

C. All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 

D. All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 

E. All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 

F. All photographs and images in the user gallery for the account; 

G. All location data associated with the account, including all information collected by the 

“Tweet With Location” service; 

H. All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 

I. All data and information that has been deleted by the user; 

J. A list of all of the people that the user follows on Twitter and all people who are following 

the user (i.e., the user’s “following” list and “followers” list); 

K. A list of all users that the account has “unfollowed” or blocked; 

L. All “lists” created by the account; 
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M. All information on the “Who to Follow” list for the account; 

N. All privacy and account settings; 

O. All records of Twitter searches performed by the account, including all past searches saved 
by the account; 

P. All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 

Q. All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 

R. All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 

S. All data and information associated with the profile page, including photographs; 

T. All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 

U. The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 

V. All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 

W. Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 

X. All activity logs for the account; 

Y. All location information for the account, including all location data collected by any 
plugins or widgets; 

Z. The types of service utilized by the user; 
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AA. All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 

BB. All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 

CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 

DD. All data and infonnation that has been deleted by the user; 

EE. The length of service (including start date) and the means and source of any payments 

associated with the service (including any credit card or bank account number); 

FF. All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 

GG. Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 

HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 

II. All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi,^^^^^^^^^^Hjulian 

individual associated with the Trump Campaign, or any witness in the 
investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY TWITTER 


Assigned To : Howell, Beryl A 
Assign. Date : 9/26/2018 ^ 
escripdon: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 


moves the Court for an Order placing the above-captioned warrant and the application and affidavit 


in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct TWITTER, LLC (“TWITTER”), an electronic 
communication and/or remote computing services provider headquartered in San Francisco, 
California, not to notify any other person (except attorneys for TWITTER for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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“district court of the United States .. . that - has jurisdiction over the offense being investigated.” 
18 U.S.C. § 271 l(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). TWITTER provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how TWITTER may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary. 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 . .. may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [s/c] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court detennines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command TWITTER not to notify any other person (except attorneys for TWITTER for the 
purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until 
further order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), and 22 U.S.C. §611 et seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
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Offenses”), arising out of the conduct of Roger Stone and others. It does not appear that Stone is 
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this 
warrant to Stone could lead him to destroy evidence or notify others who may delete information 
relevant to the investigation. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that TWITTER and its employees be directed not to notify any other person of 
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of 
receiving legal advice) for a period of one year or until further order of the Court. Such an order 
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and 
nature of which is neither public nor known to the targets of the investigation, and its disclosure 
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of 
the Warrant and related papers may also alert the targets to the scope of information known to the 
FBI. Once alerted to this infonnation, potential targets would be immediately prompted to destroy 
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and 
otherwise take steps to undermine the investigation and avoid future prosecution. In particular, 
given that they are known to use electronic communication and remote computing services, the 
potential target could quickly and easily destroy or encrypt digital evidence relating to their 
criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with TWITTER, the United States is aware that, absent a 
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal 
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
TWITTER not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 

Respectfully submitted, 


Dated: ^ /'Z C ^/jS 


ROBERT S. MUELLER, III 
Special Counsel. 



KyL. 
ThcR 


\Freeny 

stial Counsel’s Office 
(202)616-3812 
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I 

L 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 2 6 Z0 I8 

J S ' district & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY TWITTER 


Case: 1:18-sc-02905 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require TWITTER, INC. (“TWITTER”), an electronic communication and/or remote 
computing services provider headquartered in San Francisco, California, not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), TWITTER and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for TWITTER for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) 

STORED AT PREMISES ) 

CONTROLLED BY GOOGLE ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of _ __ California 

(identify the person or describe the property to be searched and give its location ): 


Case: 1:18-sc-02906 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _ Octobe r 9, 2018_ _ (not to exceed 14 days) 

gf in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. H owell , Chief U.S. District J udge . 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_ days (not to exceed30) □ until, the facts justifying, the later specific date of _ _. 

Date and time issued: f /?*>/ f Yff 


Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 


City and state: Washin gton, DC 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Return 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with: 

Inventory made in the presence of: 

Inventory of the property taken and name of any person(s) seized: 


_ Certification _ 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: ___ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California: 



- 1 - 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google+ information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, ^^^^^^^^^^^^ulian 
Assange, Randy 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II.a. 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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AO 106 (Rev 04/10) Application for a Search Warrant 


United States District Court 


for the 

District of Columbia 


r a c m o 

SEP 2 6 2018 

Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the properly to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BYGOOGIF 


Case: 1:18-sc-02906 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Northern _ District of_ California _, there is now concealed (identify the 

person or describe the property to be seized) I 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

[?f evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 



Sworn to before me and signed in my presence. 

Date: f/jd/je/F _ 

Judge '.v signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and title 
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SEP 2 6 2018 

IN THE UNITED STATES DISTRICT COURT Cleric, U.S. District & bankruptcy 
FOR THE DISTRICT OF COLUMBIA Co,JrJs f °r the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY GOOGLE, LLC 


Case: 1:18-sc-02906 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with the Google account 
which is stored at premises owned, maintained, controlled or operated by Google, LLC 
(“Google”), a company headquartered in Mountain View, Cali forma, | v 

■HM MUpon receipt of the information described in Attachment A, government-authorized 

persons will review that information to locate the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(l )(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a ‘“mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. //WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. //Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctY' me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE,Others Regarding 
Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a search warrant for STONE’s ^^^^Jaddress, On October 

17, 2017, Chief Judge Howell issued a search warrant for one of STONE’s^^^|addresses, 

or about December 19, 2017, Chief Judge Howell issued a search 
warrant for^^^^^^^|email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 2016, emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now . . . .” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
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appears to have forwarded the message to STONE at replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18, 2016, CORSI emailed STONE adHflHHflfljjHflfl 
with the title, “Roger — why don't you look this over before I send it to^^^^^H I believe that 

CORSI 

■MBBMBHM Jand I did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, using an email to 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, using^^^^^^^^^^^^^^Lmailed 

CORSI with the subject line, “Call me MON.” The body of the email readL^^^^^should see 
Assangef.] ^^^^^hould find Bemie [Sjanders.brother who called Bill a Rapist - turn him for 
Trumpf.] ^^^^^hould End more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, 2016, 


an associate of STONE’s, emailed 


STONE at 


The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ^^^^^^^subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE.^^^^^^|also stated 
that in 2018,told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told was joking and 

had not actually met ASSANGE. 2 


48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 


suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to^^^^^^^^to have “dined” with ASSANGE. For example, an associate of 


STONE sent a text to STONE at approximately 3:3 8PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
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call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 

me a today you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 

you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31,2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 

Is NY Post to use the Pedesta stuff?” 

53. On or about September 24, 2016,^^^^^^^^mailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.”^^^^^^|wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators,indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 


-14- 








Case l:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 25 of 58 


54. On or about October 3, 2016, an associate of STONE emailed STONE at 
md asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE at What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer^^^Jis a big 
democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

According to phone records^^^^^^^^^^^^^^^^^^^ at 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. ' At approximately 1:42PM, STONE called CORSI and the two spoke for 

approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


3 https://www.washingtonpost.com/Iifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 Id74714-8ce5-l le6-875e-2clbfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 

On or about August 2, 2016, CORSI emailed STONE using “I expect 

that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM, author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 

with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 

newly-released Podesta emails. Approximately ten minutes later, STONE, using 

Players02@gmail.com, forwarded^^^^Jmessage to CORSI without comment. STONE 

does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 


68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 


usingl 


emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

ith the subject 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
‘PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 

CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like skimmed maybe billions off Skolkovo — Skolkovo kept their money with 

Metcombank[.] The Russians launched a criminal investigation]?] [web link] Once^^^^^^f 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 



emailed STONE at both 
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Russia & Metcombank[.J I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reportersf.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,j You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by^^^^^^Jwith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

the subject, “Fwd: 

ASSANGE.. .URGENT..CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.j I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 





Case l:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 32 of 58 



-22- 





Case l:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 33 of 58 



I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 

88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHiIlary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. ... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. . .. [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, ‘“Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CRED1CO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for peijury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Faceboolc post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headachef.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . . . You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
.. . you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee .. . But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

. . When you start bringing up my dog, you’re crossing the linef.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

Ele was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 



5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING GOOGLE 


112. In my training and experience, I have learned that Google provides a variety of on¬ 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 
application information. In my training and experience, such information may constitute evidence 
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of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

113. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

114. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

115. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
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technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

116. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

117. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
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the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time ( e.g ., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

FILTER REVIEW PROCEDURES 

118. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

119. Based on the forgoing, I request that the Court issue the proposed search warrant. 

120. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 

121. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These . 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Subscribed and sworn to before me on 


Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 


this"day of September, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California: 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google+ information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange. 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 


Randy Credico, any 


- 5 - 




Case l:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 50 of 58 


g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II.a. 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: 1:18-sc-02906 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. S 27051b! 


The United States of America, moving by and through its undersigned counsel, respectfully 


moves the Court for an Order placing the above-captioned warrant and the application and affidavit 


in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mountain View, California, not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 


1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States . . . that - has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 271 l(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [s/c] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 

§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a 
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject Offenses”), in 
connection with efforts to compromise the networks of the Democratic National Convention 
(“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the email accounts 
of U.S. persons, followed by the public release of stolen materials through various outlets. 
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7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the investigation, and its disclosure may alert these 
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and 
related papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, 
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or 
electronic communications for a certain account, notify the subscriber or customer of the existence 
of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 

Respectfully submitted, 

ROBERT S. MUELLER, III 

Dated: 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



SEP 2 6 2018 


Clerk, U.S. District & 
Courts for the District 


Gankruptcy 

Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: 1:18-sc-02906 
Assigned To : Howell, Beryl A 
Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google, an electronic communication and/or remote computing services provider 
headquartered in Mountain View, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

Case: 1:18-sc-02918 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the N orth ern District of _ California 

(identify the person or describe the property to be searched and give its location): 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH TWO ACCOUNTS ) 
STORED AT PREMISES ) 

CONTROLLED BY TWITTER ) 


See Attachment A 


I find that the affidavit/s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 

See Attachment B 


i 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 _ (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_H on. Beryl A. Howell, Chief U.S. District Judge . 

(United States Magistrate Judge) 


□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 1 \ ' 

□ for_days (not to exceed30) □ until, the facts justifying, the later specific date 1 of 


Date and time issued: 





City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


_ Certification _ 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date:_ ___ 

Executing officer *s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Twitter accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 
operated by Twitter, Inc. (“Twitter”), a company headquartered in San Francisco, California 
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ATTACHMENT B 


I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Twitter, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 
information to the government for each account listed in Attachment A: 

A. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 

B. The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 

C. All data and information associated with the profrle page, including photographs, “bios,” 
and profile backgrounds and themes; 

D. All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 

E. All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 

F. All photographs and images in the user gallery for the account; 

G. All location data associated with the accoimt, including all information collected by the 

“Tweet With Location” service; 

H. All information about the account’s use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 

I. All data and information that has been deleted by the user; 

J. A list of all of the people that the user follows on Twitter and all people who are following 

the user (i.e., the user’s “following” list and “followers” list); 

K. A list of all users that the account has “unfollowed” or blocked; 

L. All “lists” created by the account; 
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M. All information on the “Who to Follow” list for the account; 

N. All privacy and account settings; 

O. All records of Twitter searches performed by the account, including all past searches saved 
by the account; 

P. All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions, and answers, 
registration IP address, payment history, and other personal identifiers; 

Q. All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 

R. All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 

S. All data and information associated with the profile page, including photographs; 

T. All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, lull 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 

U. The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 

V. All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 

W. Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses. Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 

X. All activity logs for the account; 

Y. All location information for the account, including all location data collected by any 
plugins or widgets; 

Z. The types of service utilized by the user; 


-3- 



Case l:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 6 of 61 


AA. All information about the account 5 s use of Twitter 5 s link service, including all website links 

embedded in, exporting data to, or importing data from, the account’s website or blog; 

BB. All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 

CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 

DD. All data and information that has been deleted by the user; 

EE. The length of service (including start date) and the means and source of any payments 

associated with the service (including any credit card or bank account number); 

FF. All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 

GG. Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 

HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 

II. All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, 

Assange, Randy 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search tenns, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 


Julian 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user ’ s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection ILa. 


-6- 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 


- 7 - 
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FILED 

SEP 2 7 2018 

IN THE UNITED STATES DISTRICT COURT courte Vof tfiTofstriS SfCoSSh 

FOR THE DISTRICT OF COLUMBIA 

IN THE MATTER OF THE SEARCH OF Case: 1 :18-SC-02918 

INFORMATION ASSOCIATED WITH TWO Assigned To : Howell, Beryl A. 

ACCOUNTS STORED AT PREMISES Assign. Date : 9/27/2018 

CONTROLLED BY TWITTER Description: Search & Seizure Warrant 

ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require TWITTER, INC. (“TWITTER”), an electronic communication and/or remote 
computing services provider headquartered in San Francisco, California, not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C, § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), TWITTER and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for TWITTER for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 

__ 

THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 

Date 


2 
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AO 106 {Rev. 04/10) Application for a Search Warrant 

United States District Court 

for the 

District of Columbia 



SEP 2 7 2018 

Glirk, U.S, District & Bankruptcy 
Courts for the District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
TWO ACCOUNTS STORED AT PREMISES 
CONTROLLED BY TWITTER 


Assian n ? ' HoWe "' Ber y f A 
Assign. Date ; 9/27/2018 ' 

Description: Search a qL 

search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
properly to be searched and give its location): 


See Attachment A 

located in the N orthern District of_ California _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fvT evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

flf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


iyf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: _ ) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
Ikyle R. Freeny (ASC) 



Applicant’s signature 


Patrick J. Myers, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 

Date: - 

Judge '$ signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C, 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 

IN THE MATTER OF THE SEARCH OF Case: 1:18-sc~02918 

INFORMATION ASSOCIATED WITH TWO Assigned To : Howell Beryl A 

ACCOUNTS STORED AT PREMISES Assign. Date ■ 9/27/2018 

CONTROLLED BY TWITTER Description: Search & Seizure Warrant 

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. $ 2705(b) 

The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct TWITTER, LLC (“TWITTER”), an electronic 
communication and/or remote computing services provider headquartered in San Francisco, 
California, not to notify any other person (except attorneys for TWITTER for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 27.11. Specifically, the Court is a 
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“district court of the United States ... that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711 (3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). TWITTER provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). 3 he 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how TWITTER may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary. 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court tor an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

' Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 


2 
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(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification; 

The explicit terms of section 2705(b) make clear that if a courts [s/c] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command TWITTER not to notify any other person (except attorneys for TWITTER for the 
purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until 
further order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), and 22 U.S.C. §611 et seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the 'Subject 
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Offenses”), arising out of the conduct of Roger Stone and others. It does not appear that Stone is 

currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this 

\ 

warrant to Stone could lead him to destroy evidence or notify others who may delete information 
relevant to the investigation. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that TWITTER and its employees be directed not to notify any other person of 
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of 
receiving legal advice) for a period of one year or until further order of the Court. Such an order 
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and 
nature of which is neither public nor known to the targets of the investigation, and its disclosure 
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of 
the Warrant and related papers may also alert the targets to the scope of information known to the 
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy 
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and 
otherwise take steps to undermine the investigation and avoid future prosecution. In particular, 
given that they are known to use electronic communication and remote computing services, the 
potential target could quickly and easily destroy or encrypt digital evidence relating to their 
criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 


4 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson , 935 F.2d at 287-89. 

10. Based on prior dealings with TWITTER, the United States is aware that, absent a 
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal 
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
TWITTER not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 

Respectfully submitted, 

ROBERT S. MUELLER, III 

Dated: °)n<l~/\% By: 

(202)616-3812 


Special Counsel 



C. Freeny 

iecial Counsel’s Office 


5 






Case l:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 18 of 61 


FILED 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 2 7 2018 

Cl»fk, U.S. District & Bankruptcy 
Courts lor the District ol Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
TWO ACCOUNTS STORED AT PREMISES 
CONTROLLED BY TWITTER 


lase:1:18-sc 02918 
assigned To : Howell, Beryl A. 
Assign. Date: 9/27/2018 

^ ~ _O OnlTl 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

l. I make this affidavit in support of an application for a search warrant for 

information associated with the two Twitter accounts (the “ 1 argct Accounts ), stored at premises 


owned, maintained, controlled or operated by Twitter, Inc. (“Twitter”), a company headquartered 
in San Francisco, California. As set forth below, the Target Accounts 

il feL.:; ■ , ,, f ;,,, f J . ’ ' .'/U _ V ■ \ "' _ j 9 Upon TCCCipt 

of the information described in Attachment A, government-authorized persons will review that 


information to locate the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation ( FBI ) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 



- 3 - 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 


Election 

9. On January 6,2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, [i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1,2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4,2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v, Viktor Borisovich Netyksho, etal. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer2.0 and WikiLeaks 

19. On June 14,2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15,2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 

the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8,2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me. 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine, 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8,2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

1 do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. 1 hear that through my emissary.” 

34. On March 27,2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges l knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So 1 am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13,2016, while WikiLeaks was in the midst of releasing the hacked 
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Podcsta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. ‘ The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: Since 1 was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rex amine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15,2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are. 

38. On or about November 9,2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: Happy? 
@wikileaks immediately followed up with another message less than a minute later: We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating. 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. It the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10,2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with STONE, 
Forthcoming Leaks 


and Others Regarding 


41. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant For STONE’s 


address, 


On October 17, 


ddresses, 


2017, Chief Judge Howell issued a search warrant for one of STONE’s 

On or about December 19, 2017, Chief Judge Howell issued a search 


warrant for 


email account. On or about March 14,2018, Chief Judge Howell 


issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 

42. On or about May 15,2016.^^^^^^^|emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now . . ..” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week. CORSI 
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appears to have forwarded the message to STONE replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18,2016, CORSI emailed STONE 
with the title, “Roger — why don’t you look this over before I send it to^^^^^K believe that 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. 1 expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5, 2016, associate of STONE’S, emailed 

STONE The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” subsequently stated to investigators that, around the 

same time, STONE told him he had gone to London to meet ASSANGE. ^^^^^Jalso stated 
that in 2018,^^^^|told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told^^^^^^Jhe was joking and 
had riot actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to ^^^^Jto have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this aftemoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, Will 
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call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’S iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15,2016, CORSI emailed STONE at 

me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31,2016, CORSI emailed STONE at 

you get the PODESTA writeup.” STONE replied 

51. On or about August 31,2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undennine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
^^^^^^^^^^^“Roger[,j Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016,^^^^Jemailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff. CORSI responded, We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about flle[.]” In a subsequent meeting with investigators,^^^^^^|indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 

and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. Ed tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that s 
important.” 

55. On or about October 4,2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process. ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype. 

57. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back,' He didn t 
cut deal w/ Clintons???” STONE replied, “Don't think so BUT his lawyet^^^^^Jis a big 
democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 

February 14, 2018, he initially denied knowing whether the October 4,2016 email to STONE 

was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 

STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 

BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7,2016, when the Podesta Emails 
Are Released. 

59. According to a publicly available news article, 3 at approximately 11 AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 

C 

calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

to phone records at 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 

Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 

then-the-race-was-on/2016/10/07/31 d74714-8ce5-11 e6-875e-2c 1 bfe943b66jstory.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using I expect 

that much of next dump focus, setting stage for Foundation debacle." 

66. At approximately 6:27PM,author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forwarded^^^^^nessage to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
mailed Corsi asking him to “send me your best podesta links.” 

STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 


using 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice? 

69. On or about that same day, October 12,2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

at both^^^^^^^^^^^^^^^^^^|with 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the^^^J'kccount, “Got them and used them.” 

71. On or about Thursday, October 13,2016, CORSI emailed STONE at 
HUmHB“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like^^^^^^kimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombankf.] The Russians launched a criminal investigation!.] [web link] Once 

had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombankf.] I’m working on that angle now.” STONE replied, Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by ^^^^^^Jwith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

ith the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[,]’ Only hope is that if 1 rump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has, 11 HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE staled that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8,2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10,2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, I m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 

88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to _ 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” Ail of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views, Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoIdtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 

expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’S “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, Ha ha. 

92. On or about November 21,2017, CREDICO messaged STONE, I was told that 

the house committee lawyer told my lawyer that I will be getting a subpoena[.] STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops? 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 

guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29,2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’... Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of peijury[.j But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back ... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, ‘ If 
you testify you’re a fool. Because of tromp [sic] 1 could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testifyf.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 


- 26 - 




Case l:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 44 of 61 


98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardonf.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs .. i + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.j I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You are a stoolie. You backstab your friends run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the linef.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 



s https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 

threatened-dog-135911370.html 

6 https://www.motherjones.com/politics/201 8 / 05 /roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING TWITTER 

115. In my training and experience, Twitter owns and operates a free-access social¬ 
networking website of the same name that can be accessed at http://www.twitter.com. twitter 
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allows its users to create their own profile pages, which can include a short biography, a photo of 
themselves, and location information. Twitter also permits users create and read 140-character 
messages called “Tweets,” and to restrict their “Tweets” to individuals whom they approve. 1 hese 

features are described in more detail below. 

116. Upon creating a Twitter account, a Twitter user must create a unique Twitter 

username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

117. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

118. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme foi his or het 
account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

119. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 
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120. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 

account, Twitter provides the user with a list of other users who have favorited or retweeted 

the user’s own Tweets, as well as a list of all Tweets that include the user s username (i.e ., a list 
of all “mentions” and “replies” for that username). 

121. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 

including images uploaded by other services. 

122. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This ‘ Tweet With Location 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

123. When Twitter users want to post a Tweet that includes a link to a.website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

124. A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
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visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

125. In addition to posting Tweets, a Twitter user can also send Direct Messages 
(DMs) to one of his or her followers. These messages are typically visible only to the sender and 
the recipient, and both the sender and the recipient have the power to delete the message from the 
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a 
particular user, but older DMs are stored on Twitter’s database. 

126. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

127. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 
25 past searches. 

128. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users public Twitter 
profiles. 

129. If a Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 
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130. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

131. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter account activity can show how and when the account was accessed or 
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
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Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the 1 witter account owner s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

132. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other 
account information 

FILTER REVIEW PROCEDURES 

133. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

134. Based on the forgoing, I request that the Court issue the proposed search warrant. 

135. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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136. I further request that the Court order that all papers in support of this application. 


including the affidavit and search warrant, be sealed until further order of the Court, these 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 



Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Twitter accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 
operated by Twitter, Inc. (“Twitter”), a company headquartered in San Francisco, California 
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ATTACHMENT B 


I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Twitter, or have been preserved 
pursuant to arequest made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 
information to the government for each account listed in Attachment A: 

A. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 

B. The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 

C. All data and information associated with the profile page, including photographs, “bios, 
and profile backgrounds and themes; 

D. All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 

E. All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 

F. All photographs and images in the user gallery for the account; 

G. All location data associated with the account, including all information collected by the 

“Tweet With Location” service; 

H. All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 

I. All data and information that has been deleted by the user; 

J. A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 

K. A list of all users that the account has “unfollowed” or blocked; 

L. All “lists” created by the account; 
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M. All information on the “Who to Follow” list for the account; 

N. All privacy and account settings; 

O. All records of Twitter searches performed by the account, including all past searches saved 
by the account; 

P. All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions, and answers, 
registration IP address, payment history, and other personal identifiers; 

Q. All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 

R. All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 

S. All data and information associated with the profile page, including photographs; 

T. All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 

U. The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 

V. All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 

W. Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 

X. All activity logs for the account; 

Y. All location information for the account, including all location data collected by any 
plugins or widgets; 

Z. The types of service utilized by the user; 
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AA. All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 

BB. . All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 

CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 

DD. All data and information that has been deleted by the user; 

EE. The length of sendee (including start date) and the means and source of any payments 

associated with the service (including any credit card or bank account number); 

FF. All privacy settings and other account settings, including email addresses or other accounts 

that the account has blocked; 

GG, Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 

HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 

II. All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1,2016 to the present, including; 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. AH records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—-including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 


-6- 




Case l:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 61 of 61 


III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH FOUR ) 

ACCOUNTS STORED AT PREMISES ) 

CONTROLLED BY FACEBOOK ) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the_ Northern _ District of California 

(identify the person or describe the property to be searched and give its location)\ 


Assigned To : Howell, Beryl A 
Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


See Attachment A 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or propeity 
described above, and that such search will reveal (identify the person or describe the property to be seized)\ 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before _ October 11,2018 (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 pan. O at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howeii, Chief U . S. District Judge . 

(United States Magistrate Judge) 

O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay ( notice to tile person who, or whose 
property, will be searched or seized (check the appropriate box) ^ t 1 >' 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specify date of / \ , : _. 

Date and time issued: 

Judge 's signature 

City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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Return 

Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was retoned along with the original warrant to the 
designated judge. 


Date: _ __ 

Executing officer *s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with die Facebook accounts registered to 
the following email addresses (“Target Facebook Accounts”), stored at premises owned, 
maintained, controlled, or operated by Facebook, Inc. (“Facebook”), a company headquartered in 
Menlo Park, California: 

This warrant also applies to information associated with the Instagram accounts registered 
to the following email addresses (“Target Instagram Accounts”), stored at premises owned, 
maintained, controlled, or operated by Facebook: 




II- 
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ATTACHMENT B 

I. Information to be disclosed by Facebook/Instagram 

A. To the extent that the information described in Attachment A is within the 
possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 
whether such information is stored, held or maintained inside or outside of the United States, and 
including any emails, records, files, logs, or information that have been deleted but are still 
available to the Provider, the Provider is required to disclose the following information to the 
government for each of the Target Facebook Accounts listed in Attachment A; 

(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 

(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 
tags; and information about the user’s access and use of Facebook applications; 


-2- 



Case l:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 5 of 71 


(e) All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

(f) All records relating to machine cookies; 

(g) All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

(h) All IP logs, including all records of the IP addresses that logged into the account; 

(i) All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

(j) All information about the Facebook pages that the account is or was a “fan” of; 

(k) All past and present lists of Mends created by the account; 

(l) All records of Facebook searches performed by the account; 

(m) All information about the user’s access and use of Facebook Marketplace; 

(n) The types of service utilized by the user; 

(o) The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

(p) Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

(q) All past and present Admins for the group; 

(r) The “Creator” of the group; 
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(s) All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

(t) All records pertaining to co mm unications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

(u) All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected and queried. 

B. To the extent that the information described in Attachment A is within the 
possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 
whether such information is stored, held or maintained inside or outside of the United States, and 
including any emails, records, files, logs, or information that have been deleted but are still 
available to the Provider, the Provider is required to disclose the following information to the 
government for each of the Target Instagram Accounts listed in Attachment A: 

a. All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers; 

b. All past and current usernames associated with the account; 

c. All activity logs for the account and all other documents showing the user’s posts 
and other Instagram activities; 
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d. The dates and times at which the account and profile were created, and the Internet 
Protocol (“IP”) address at the time of sign-up; 

e. All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

f. All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; friend lists, including the friends’ and 
followers’ Instagram user identification numbers; groups and networks of which 
the user is a member, including the groups’ Instagram group identification numbers; 
future and past event postings; tags; 

g. All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” or “follower” requests; 

h. All records relating to machine cookies; 

i. All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

j. All IP logs, including all records of the IP addresses that logged into the account; 

k. All records of the account’s usage of the “follow” feature, including all Instagram 
posts and all non-Instagram webpages and content that the user has “liked”; 

l. All past and present lists of friends created by the account; 

m. All records of Instagram searches performed by the account; 

n. The types of service utilized by the user; 
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o. The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

p. All information regarding the particular device or devices used to login to or access 
the account, including device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 

q. Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

r. All past and present Admins for the group; 

s. The “Creator” of the group; 

t. All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

u. All records pertaining to communications between Facebook or Instagram and any 
person regarding the user or the user’s Instagram account, including contacts with 
support services and records of actions taken. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
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U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy any 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 
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f. Co mmun ications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who co mm unicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 
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n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection ILa. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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FIS, ID 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 2 7 5 


U.S. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH FOUR 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY FACEBOOK 


Case: 1:18-sc-02919 
Assigned To : Howell, Beryl A 
Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Facebook, Inc. (“Faceboolc”), an electronic communication and/or remote 
computing services provider headquartered in Menlo Park, California, not to disclose the existence 
or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 


. IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Facebook and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Facebook for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 



THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 


jirM 

Date 


2 
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United States District Court 

for the 



SB' ? 1 


District of Columbia Clerk, U.8. District & Dnnkruptcy 

Courts for the District of Columbia 


In the Matter of the Search of \ 

(Briefly describe the property to be searched ) 

or identify the person by name and address) \ 

INFORMATION ASSOCIATED WITH < 

FOUR ACCOUNTS STORED AT PREMISES ) 

CONTROLLED BY FACEBOOK ) 


Case: 1:18-sc-02919 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Northern _ District of __ California _, there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
ivf evidence of a crime; 

l?f contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add’l 

The application is based on these facts: 

See attached Affidavit. 


Q( Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: __) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
Kyle R. Freeny (ASC) 



Applicant’s signature 


Patrick J. Myers, S pecial Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 

Judge's signature 

City and state: Washington, D.C. _ Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 


Date: 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


htr L 1 20 ! 

Clerk, U.S, District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
FOUR ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
FACEBOOK 


Case: 1:18-sc-02919 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with the two Facebook accounts and two Instagram accounts (the “Target 
Accounts”), stored at premises owned, maintained, controlled or operated by Facebook, Inc. 
(“Facebook”), a company headquartered in Menlo Park, California. As set forth below, the Target 
Accounts arc believed to 

p on receipt of the information described in Attachment A, government-authorized 

persons will review that information to locate the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 


-1- 


Case l:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 16 of 71 


intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
l. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 


- 2 - 



Case l:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 17 of 71 


Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the. Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against tar gets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida comities. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
lias intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have co mm unicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18,2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance 5 of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
fonn of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1,2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2,2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7,2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta ffimWithller” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikilealcs. ! The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was alt over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

3 7. On or about October 15,2016, @RogerJStoneJr sent a direct message to 

@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4,2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


1 On or about August 7,2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coining most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSPs Communications with STONE, 

Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONB’s ^^^^Jaddress,^^^^^^^^^^^^^^| On October 17, 
2017, Chief Judge Howell issued a search warrant for one of STONE’s ^^Jaddresses, 

On or about December 19, 2017, Chief Judge Howell issued a search 
warrant for ^^^^^^^Jemail account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15,2016,^^^^^^|emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now ....” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


and Others Regarding 
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appears to have forwarded the message to STONE at who replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 


43. On or about May 18, 2016, CORSI emailed STONE at| 
with the title, “Roger — why don't you look this over before I send it to 


I believe that 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke - 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSFs reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5,201an associate of STONE’s, emailed 

STONE at^^^^^^^^^^^^The email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ^^^^^^ubsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE.^^^^^^|also stated 
that in 2018, told STONE he would be interviewed by the FBI and would have to 

divulge the conversation about meeting ASSANGE. STONE tolc^^^^^^J he was joking and 
had not actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to ^^^^^Jto have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:3 8PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this aftemoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
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call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCIond that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15,2016, CORSI emailed STONE at 

“Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31,2016, CORSI emailed STONE at 

“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31,2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6,2016, CORSI emailed STONE at 
^^^^^^^^^^^^^^^Roger[,] Is NY Post to use the Pedesta [sic] stuff?” 

53. On or about September 24, 201emailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.”^^^^^^^Pvrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators,indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3,2016, an associate of STONE emailed STONE at 

and asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4,2016, AS SANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don’t think so BUT his lawyer a big 

democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

According to records^^^^^^^^^^^^^^^^^^^|at 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 

then-the-race-was-on/2016/10/07/31 d74714-8ce5-1 Ie6-875e-2clbfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using 
that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM, an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

'orwarded ^^^^^nessage to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 




numbers.” 

68. On or about Wednesday, October 12,2016, at approximately 8:17AM, STONE, 


using I 


^^^^^^^^^^Jpnailed Corsi asking him to “send me your best podesta links.’ 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “01c. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. 1 can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12,2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

at with 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the. heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13,2016, CORSI emailed STONE at 

“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like ^^^^Jskimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation^] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13,2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at^^^^^^^^^^^ith the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by ^^^^^Jwith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 


with the header information stripped out, showing only the body text. Ihe email read, “Yes[.j I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man fdes that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, tire 
“trusted source” was a self-identified retired librarian who gathers information from public chat 


rooms. 

76. On or about October 18,2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikilealcs, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8,2016, the United States presidential election took place. 

79. On or about November 9,2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the healing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge ot 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21,2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood Mend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That- 

Q: - was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19,2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21,2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told nre was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it On. I told you to watch his Tweets in October not before that I knew nothing 
about die DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for peijury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28,2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28,2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29,2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12,2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of peijury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 


- 26 - 



Case l:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 41 of 71 


98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.J” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8,2018, CREDICO messaged STONE, stating: “Embassy 

logs_+ 17 other pieces of information prove that I did not have any conversations with 

Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25,2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’H get 
off because you’re friends with Trump so don’t won-y. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 3 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 5 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In tire article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 



5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 

threatened-dog-135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING FACEBOOK 

116. Facebook owns and operates a free-access social networking website of the same 
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish 
accounts with.Facebook, and users can then use their accounts to share written news, photographs, 
videos, and other infonnation with other Facebook users, and sometimes with the general public. 

117. Facebook asks users to provide basic contact and personal identifying information 
to Facebook, either during the registration process or thereafter. This information may include the 
user’s full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook 
security questions and answers (for password retrieval), physical address (including city, state, and 
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook 
also assigns a user identification number to each account. 

118. Facebook users may join one or more groups or networks to connect and interact 
with other users who are members of the same group or network. Facebook assigns a group 
identification number to each group. A Facebook user can also connect directly with individual 
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request” 
accepts the request, then the two users will become “Friends” for purposes of Facebook and can 
exchange communications or view information about each other. Each Facebook user’s account 
includes a list of that user’s “Friends” and a “News Feed,” which highlights information about the 
user’s “Friends,” such as profile changes, upcoming events, and birthdays. 

119. Facebook users can select different levels of privacy for the communications and 
information associated with their Facebook accounts. By adjusting these privacy settings, a 
Facebook user can make information available only to himself or herself, to particular Facebook 
users, or to anyone with access to the Internet, including people who are not Facebook users. A 


- 32 - 




Case l:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 47 of 71 

Facebook user can also create “lists” of Facebook friends to facilitate the application of these 
privacy settings. Facebook accounts also include other account settings that users can adjust to 
control,, for example, the types of notifications they receive from Facebook. 

120. Facebook users can create profiles that include photographs, lists of personal 
interests, and other information. Facebook users can also post “status” updates about their 
whereabouts and actions, as well as links to videos, photographs, articles, and other items available 
elsewhere on the Internet. Facebook users can also post information about upcoming “events,” 
such as social occasions, by listing the event’s time, location, host, and guest list. In addition, 
Facebook users can “check in” to particular locations or add their geographic locations to their 
Facebook posts, thereby revealing their geographic locations at particular dates and times. A 
particular user’s profile page also includes a “Wall,” which is a space where the user and his or 
her “Friends” can post messages, attachments, and links that will typically be visible to anyone 
who can view the user’s profile. 

121. Facebook allows users to upload photos and videos, which may include any 
metadata such as location that the user transmitted when s/he uploaded the photo or video. It also 
provides users the ability to “tag” (i.e., label) other Facebook users in a photo or video. When a 
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the 
photo or video. For Facebook’s purposes, the photos and videos associated with a user’s account 
will include all photos and videos uploaded by that user that have not been deleted, as well as all 
photos and videos uploaded by any user that have that user tagged in them. 

122. Facebook users can exchange private messages on Facebook with other users. 
These messages, which are similar to e-mail messages, are sent to the recipient’s “Inbox” on 
Facebook, which also stores copies of messages sent by the recipient, as well as other information. 
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Facebook users can also post comments on the Facebook profiles of other users or on their own 
profiles; such comments are typically associated with a specific posting or item on the profile. In 
addition, Facebook has a Chat feature that allows users to send and receive instant messages 
through Facebook. These chat communications are stored in the chat history for the account. 
Facebook also has a Video Calling feature, and although Facebook does not record the calls 
themselves, it does keep records of the date of each call. 

123. If a Facebook user does not want to interact with another user on Facebook, the 
first user can “block” the second user from seeing his or her account. 

124. Facebook has a “like” feature that allows users to give positive feedback or connect 
to particular pages. Facebook users can “like” Facebook posts or updates, as well as webpages or 
content on third-party (/. c., non-Facebook) websites. Facebook users can also become fans of 
particular Facebook pages. 

125. Facebook has a search function that enables its users to search Facebook fox- 
keywords, usernames, or pages, among other things. 

126. Each Facebook account has an activity log, which is a list of the user’s posts and 
other Facebook activities from the inception of the account to the present. The activity log includes 
stories and photos that the user has been tagged in, as well as connections made through the 
account, such as “liking” a Facebook page or adding someone as a friend. The activity log is 
visible to the user but cannot be viewed by people who visit the user’s Facebook page. 

127. Facebook Notes is a blogging feature available to Facebook users, and it enables 
users to write and post notes or personal web logs (“blogs”), or to import their blogs from other 
services, such as Xanga, Live Journal, and Blogger. 
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128. The Facebook Gifts feature allows users to send virtual “gifts” to their friends that 
appear as icons on the recipient’s profile page. Gifts cost money to purchase, and a personalized 
message can be attached to each gift. Facebook users can also send each other pokes, which are 
free and simply result in a notification to the recipient that he or she has been “poked” by the 
sender. 

129. Facebook also has a Marketplace feature, which allows users to post free classified 
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace. 

130. In addition to the applications described above, Facebook also provides its users 
with access to thousands of other applications (“apps”) on the Facebook platform. When a 
Facebook user accesses or uses one of these applications, an update about that the user’s access or 
use of that application may appear on the user’s profile page. 

131. Some Facebook pages are affiliated with groups of users, rather than one individual 
user. Membership in the group is monitored and regulated by the administrator or head of the 
group, who can invite new members and reject or accept requests by users to enter. Facebook can 
identify all users who are currently registered to a particular group and can identify the 
administrator and/or creator of the group. Facebook uses the term “Group Contact Info” to 
describe the contact information for the group’s creator and/or administrator, as well as a PDF of 
the current status of the group profile page. 

132. Facebook uses the term “Neoprint” to describe an expanded view of a given user 
profile. The “Neoprint” for a given user can include the following information from the user’s 
profile: profile contact information; News Feed information; status updates; links to videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends’ 
Facebook user identification numbers; groups and networks of which the user is a member, 
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including tlic groups 5 Facebook group identification numbers; futuie and past event postings, 
rejected “Friend 55 requests; comments; gifts; pokes; tags; and information about the user’s access 
and use of Facebook applications. 

133. Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP address. 
These logs may contain information about the actions taken by the user ID or IP address on 
Facebook, including information about the type of action, the date and tune of the action, and the 
user ID and IP address associated with the action. For example, if a user views a Facebook profile, 
that user’s IP log would reflect the fact that the user viewed the profile, and would show when and 
from what IP address the user did so. 

134. Social networking providers like Facebook typically retain additional information 
about their users’ accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the service 
(including any credit card or bank account number). In some cases, Facebook users may 
communicate directly with Facebook about issues relating to their accounts, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 
Facebook typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. 

135. As explained herein, information stored in connection with a Facebook account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Facebook user’s “Neoprint,” IP log, stored electronic communications, and other data retained by 


- 36 - 




Case l:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 51 of 71 


Facebook, can indicate who has used or controlled the Facebook account. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a search warrant 
at a residence. For example, profile contact information, private messaging logs, status updates, 
and tagged photos (and the data associated with the foregoing, such as date and time) may be 
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook 
account activity can show how and when the account was accessed or used. For example, as 
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their 
accounts along with the time and date. By detemiining the physical location associated with the 
logged IP addresses, investigators can understand the chronological and geographic context of the 
account access and use relating to the crime under investigation. Such information allows 
investigators to understand the geographic and chronological context of Facebook access, use, and 
events relating to the crime under investigation. Additionally, Facebook builds geo-location into 
some of its services. Geo-location allows, for example, users to “tag” their location in posts and 
Facebook “friends” to locate each other. This geographic and timeline information may tend to 
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may 
provide relevant insight into the Facebook account owner’s state of mind as it relates to the offense 
under investigation. For example, information on the Facebook account may indicate the owner’s 
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from 
law enforcement). 

136. Therefore, the computers of Facebook are likely to contain all the material 
described above, including stored electronic communications and information concerning 
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subscribers and their use of Facebook, such as account access information, transaction information, 
and other account information. 

BACKGROUND CONCERNING INSTAGRAM 

137. From my review of publicly available information provided by Instagram about 
its service, including Instagram’s “Privacy Policy,” I am aware of the following about Instagram 
and about the information collected and retained by Instagram. 

138. Instagram is a social networking service owned by Facebook, Inc. Instagram 
owns and operates a free-access social-networking website of the same name that can be 
accessed at http://www.instagram.com. Instagram allows its users to create their own profile 
pages, which can include a short biography, a photo of themselves, and other information. Users 
can access T nstagram through the Instagram website or by using a special electronic application 
(“app”) created by the company that allows users to access the service through a mobile device. 

139. Instagram permits users to post photos to their profiles on Instagram and 
otherwise share photos with others on Instagram, as well as certain other social-media services, 
including Flickr, Facebook, and Twitter. When posting or sharing a photo on Instagram, a user 
can add to the photo: a caption; various “tags” that can be used to search for the photo ( e.g ., a 
user made add the tag #vw so that people interested in Volkswagen vehicles can search for and 
find the photo); location information; and other information. A user can also apply a variety of 
“filters” or other visual effects that modify the look of the posted photos. In addition, Instagram 
allows users to make comments on posted photos, including photos that the user posts or photos 
posted by other users of Instagram. Users can also “like” photos. 
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140. Upon creating an Instagram account, an Instagram user must create a unique 
Instagram username and an account password. This information is collected and maintained by 
Instagram. 

141. Instagram asks users to provide basic identity and contact information upon 
registration and also allows users to provide additional identity information for their user profile. 

This information may include the user’s full name, e-mail addresses, and phone numbers, as well 

\ 

as potentially other personal information provided directly by the user to Instagram. Once an 
account is created, users may also adjust various privacy and account settings for Hie account on 
Instagram. Instagram collects and maintains this information. 

142. Instagram allows users to have “friends,” which are other individuals with whom 
the user can share information without making the information public. Friends on Instagram 
may come from either contact lists maintained by the user, other third-party social media 
websites and information, or searches conducted by the user on Instagram profiles. Instagram 
collects and maintains this information. 

143. Instagram also allows users to “follow” another user, which means that they 
receive updates about posts made by the other user. Users may also “unfollow” users, that is, 
stop following them or block the, which prevents the blocked user from following that user. 

144. Instagram allow users to post and share various types of user content, including 
photos, videos, captions, comments, and other materials. Instagram collects and maintains user 
content that users post to Instagram or share through Instagram. 

145. Instagram users may send photos and videos to select individuals or groups via 
Instagram Direct. Information sent via Instagram Direct does not appear in a user’s feed, search 
history, or profile. 
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146. Users on Instagram may also search Instagram for other users or particular types 
of photos or other content. 

147. For each user, Instagram also collects and retains information, called “log file” 
information, every time a user requests access to Instagram, whether through a web page or 
through an app. Among the log file information that Instagram’s servers automatically record is 
the particular web requests, any Internet Protocol (“IP) address associated with the request, type 
of browser used, any referring/exit web pages and associated URLs, pages viewed, dates and 
times of access, and other information. 

148. Instagram also collects and maintains “cookies,” which are small text files 
containing a string of numbers that are placed on a user’s computer or mobile device and that 
allows Instagram to collect infonnation about how a user uses Instagram. For example, 
Instagram uses cookies to help users navigate between pages efficiently, to remember 
preferences, and to ensure advertisements are relevant to a user’s interests. 

149. Instagram also collects information on the particular devices used to access 
Instagram. In particular, Instagram may record “device identifiers,” which includes data files 
and other information that may identify the particular electronic device that was used to access 
Instagram. 

150. Instagram also collects other data associated with user content. For example, 
Instagram collects any “hashtags” associated with user content (i.e., keywords used), “geotags” 
that mark the location of a photo and which may include latitude and longitude information, 
comments on photos, and other information. 

151. Instagram also may communicate with the user, by email or otherwise. Instagram 
collects and maintains copies of communications between Instagram and the user. 
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152. As explained herein, information stored in connection with an Instagram account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, 
an Instagram user’s account activity, IP log, stored electronic communications, and other data 
retained by Instagram, can indicate who has used or controlled the Instagram account. This 
“user attribution” evidence is analogous to the search for “indicia of occupancy” while executing 
a search warrant at a residence. For example, profile contact information, direct messaging logs, 
shared photos and videos, and captions (and the data associated with the foregoing, such as geo- 
location, date and time) may be evidence of who used or controlled the Instagram account at a 
relevant time. Further, Instagram account activity can show how and when the account was 
accessed or used. For example, as described herein, Instagram logs the Internet Protocol (IP) 
addresses from which users access their accounts along with the time and date. By determining 
the physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the account access and use relating to the crime under 
investigation. Such information allows investigators to understand the geographic and 
chronological context of Instagram access, use, and events relating to the crime under 
investigation. Additionally, Instagram builds geo-location into some of its services. Geo- 
location allows, for example, users to “tag” their location in posts and Instagram “friends” to 
locate each other. This geographic and timeline information may tend to either inculpate or 
exculpate the Instagram account owner. Last, Instagram account activity may provide relevant 
insight into the Instagram account owner’s state of mind as it relates to the offense mider 
investigation. For example, information on the Instagram account may indicate the owner’s 
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motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from 
law enforcement). 

153. Based on the i nf ormation above, the computers of Instagram are likely to contain 
all the material described above with respect to the Target Instagram Accounts, including stored 
electronic communications and information concerning subscribers and their use of Instagram, 
such as account access information, which would include information such as the IP addresses 
and devices used to access the account, as well as other account information that might be used 
to identify the actual user or users of the account at particular times. 

FILTER REVIEW PROCEDURES 

154. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

155. Based on the forgoing, I request that the Court issue the proposed search warrant. 

156. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

157. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the foil nature and extent of which is not 
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known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Patrick J. Myers 
Special Agent 

• Federal Bureau of Investigation 

Subscribed and sworn to before me on this x/ day of September, 2018. 





The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Facebook accounts registered to 
the following email addresses (“Target Facebook Accounts”), stored at premises owned, 
maintained, controlled, or operated by Facebook, Inc. (“Facebook”), a company headquartered in 
Menlo Park, California: 

This warrant also applies to information associated with the Instagram accounts registered 
to the following email addresses (“Target Instagram Accounts”), stored at premises owned, 
maintained, controlled, or operated by Facebook: 
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ATTACHMENT B 

I. Information to be disclosed by Facebook/Instagram 

A. To the extent that the information described in Attachment A is within the 
possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 
whether 3 uch information is stored, held or maintained inside or outside of the United States, and 
including any emails, records, files, logs, or information that have been deleted but are still 
available to the Provider, the Provider is required to disclose the following information to the 
government for each of the Target Facebook Accounts listed in Attachment A: 

(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 

(b) All activity logs for die account and all other documents showing the user’s posts 
and other Facebook activities; 

(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including , 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 
tags; and information about the user’s access and use of Facebook applications; 
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(e) All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

(f) All records relating to machine cookies; 

(g) All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

(h) All IP logs, including all records of the IP addresses that logged into the account; 

(i) All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

1 'i 

G) All hiformation about the Facebook pages that the account is or was a “fan” of; 

(k) All past and present lists of friends created by the account; 

(l) All records of Facebook searches performed by the account; 

(m) All information about the user’s access and use of Facebook Marketplace; 

(n) The types of service utilized by the user; 

(o) The length of service (including start ,date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

(p) Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

(q) All past and present Admins for the group; 

(r) The “Creator” of the group; 
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(s) All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

(t) All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

(u) All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected and queried. 

B. To the extent that the information described in Attachment A is within the 
possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 
whether such information is stored, held or maintained inside or outside of the United States, and 
including any emails, records, files, logs, or information that have been deleted but are still 
available to the Provider, the Provider is required to disclose the following infonnation to the 
government for each of the Target liistagram Accounts listed in Attachment A: 

a. All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers; 

b. All past and current usernames associated with the account; 

c. All activity logs for the account and all other documents showing the user’s posts 
and other Instagram activities; 
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d. The dates and times at which the account and profile were created, and the Internet 
Protocol (“IP”) address at the time of sign-up; . 

e. All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

f. AH profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; friend lists, including the friends’ and 
followers’ Instagram user identification numbers; groups and networks of which 
the user is a member, including the groups’ Instagram group identification numbers; 
future and past event postings; tags; 

g. All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” or “follower” requests; 

h. All records relating to machine cookies; 

i. All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

j. All IP logs, including all records of the IP addresses that logged into the account; 

k. All records of the account’s usage of the “follow” feature, including all Instagram 
posts and all non-Ins'tagram webpages and content that the user has “liked”; 

i 

l. All past and present lists of friends created by the account; 

m. All records of Instagram searches performed by the account; 

n. The types of service utilized by the user; 
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o. The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

\ 

p. All information regarding the particular device or devices used to login to or access 
the account, including device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 

q. Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

r. All past and present Admins for the group; 

s. The “Creator” of the group; 

t. All privacy settings and other account settings, including privacy settings for 

i 

l 

individual kistagram posts and activities, and all records showing which Instagram 
users have been blocked by the account; 

u. All records pertaining to communications between Facebook or Instagram and any 
person regarding the user or the user’s Instagram account, including contacts with 
support services and records of actions taken. 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
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U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Mian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 
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f. Co mmuni cations, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to tire account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 
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n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II.a. 

T IT. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 

IN THE MATTER OF THE SEARCH OF Case: 1 : 18-SC-02919 

INFORMATION ASSOCIATED WITH FOUR Assigned To : Howell, Beryl A. 
ACCOUNTS STORED AT PREMISES Assign. Date : 9/27/2018 

CONTROLLED BY FACEBOOIC Description: Search & Seizure Warrant 

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. $ 2705161 

The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Facebook, Inc. (“Facebook”), an electronic 
communication and/or remote computing services provider headquartered in Menlo Park, 
California, not to notify any other person (except attorneys for Facebook for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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“district court of the United States ... that - has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the W arrant under 18 
U.S.C. § 2705(b). Facebook provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Facebook may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part. Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) inti mi dation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.G. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d T, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Facebook not to notify any other person (except attorneys for Facebook for the purpose 
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating, among other things, 
violationsof 18 U.S.C. § 2 (aiding and abetting), 18U.S.C. § 3 (accessory after the fact), 18U.S.C. 
§4 (misprision of a felony), 18 U.S.C. §371 (conspiracy), 18 U.S.C. §951 (acting as an 
unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 
18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
and 22 U.S.C. § 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign 

contribution ban) (the “Subject Offenses”), in connection with efforts to compromise the networks 
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of the Democratic National Convention (“DNC”), the Democratic Congressional Campaign 
Committee (“DCCC”), and the email accounts of U.S. persons involved in the 2016 presidential 
election, followed by the public release of stolen materials through various outlets. 

7. In this matter, the government requests that tire Warrant be sealed until further order 
of the Court and that Facebook and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Facebook for tire pmpose of receiving 
legal advice) for a period of one year or imtil further order of the Court. Such an order is 
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature 
of which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant 
and related papers may also alert the targets to the scope of information known to the FBI. Once 
alerted to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
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to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson , 935 F.2d at 287-89. 

10. Based on prior dealings with Facebook, the United States is aware that, absent a 
court order under Section 2705(b) commanding Facebook not to notify anyone about a legal 
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored wire 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Facebook not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year 
or until further order of the Court. 

Respectfully submitted, 

ROBERT S. MUELLER, III 


Dated: ^ /Z'l' Af\ By: 


Special Counsel 



ICyleTLNKreeny 
The Special Counsel’s Office 
(202)616-3812 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH THREE 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY MICROSOFT 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Western _ District of _ Washington 

(identify the person or describe the property to be searched and give its location)'. 


Z!an e n T r H ° Wel, ’ B ^IA 
n gn> Date: 9/27/2018 ' 

Description: Search & Seizure Warrant 


See Attachment A 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11,2018 _ ( no t to exceed 14 days) 

in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howell, Chief U.S. District Judge . 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

■ . , i 

□ for_days (not to exceed SO) O until, the facts justifying, the later specific date of __. 

Date and time issued: j/i-f/'Zfl/? of fa f /A 

City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/J 3) Search and Seizure Warrant (Page 2) 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: __ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Microsoft accounts, 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation 
(“Microsoft”), a company headquartered in Redmond, Washington: 

This warrant also applies to information associated with the following Slcype usernames 
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft 
Corporation, an electronic communication and/or remote computing service provider with 
headquarters in Redmond, Washington: 
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ATTACHMENT B 

I. Information to be disclosed by Microsoft 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Microsoft Corporation (hereinafter “the Provider”), regardless of whether 
such information is stored, held or maintained inside or outside of the United States, and including 
any emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. The contents of all Skype communications sent to or from the account, including 
videos, instant messages, group messages, and attachments, as well as the complete 
conversation history for the account; 

c. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

d. The types of service utilized; 
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e. All Windows Live and OneDrive data and content; 

f. All Microsoft Developer information and content and any other information and 

content relating to software development and testing; 

g. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

h. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

i. All Lync content; 

j. All subscriber “change history” associated with the account; 

k. All search history and web history associated with the account (including Bing 

history); 

l. All location and maps information associated with the account; 

A i 

m. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 

n. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 


-3- 




Case l:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 6 of 56 


which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of comiecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi,^^|^^^^^^^|julian 
Assange, Randy 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 
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j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT SEP 7 2t)t8' 

FOR THE DISTRICT OF COLUMBIA clerk, y.s. District & Bankruptcy 

Courts lor the District oi Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED 
AT PREMISES CONTROLLED BY 
MICROSOFT CORPORATION 


Case: 1:18-sc-02920 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Microsoft Corporation (“Microsoft”), an electronic communication and/or remote 
computing services provider headquartered in Redmond, Washington, not to disclose the existence 
or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Microsoft and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Microsoft for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 
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United States District Court FILED 


for the 

District of Columbia 


In the Matter of the Search of ^ 

(Briefly describe the property to be searched ) 

or identify the person by name and address) v 

INFORMATION ASSOCIATED WITH < 

THREE ACCOUNTS STORED AT PREMISES ) 

CONTROLLED BY MICROSOFT ) 


SEP 2 7 2(118 

Clerk, U.S, District & Bankruptcy 

Coutte for th&.Dtetriet of (MHKtils? 

Case: 1:18-sc-02920 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I .have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Western District of_ Washington , there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

S(property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


0 Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: 



Kyle R. Freeny (ASC) 


Applicant’s signature 

Patrick J. Myers, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 

Date: 

Judge *s signature 

City and state: Washingto n, D.C. _ Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 2 J 2018 

Clerk, IJ.S. District & bankruptcy 
Courts tor the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
MICROSOFT 


Case: 1:18-sc-02920 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 


1. I make this affidavit in support of an application for a search warrant for 

information associated with the Microsoft email account “Target 

Accounts 1”) and the Skype accounts registered to (“Target Account 

2”) and Account 3”), stored at premises owned, 

maintained, controlled or operated by Microsoft Corporation (“Microsoft”), a company 

Upon receipt of the information described in Attachment A, government-authorized persons will 
. review that information to locate the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 


-1- 





Case l:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 13 of 56 


3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of aprotected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) ... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 
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PROBABLE CAUSE 
A. Background on Relevant Individuals 

i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained Ms support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 

L 

information, served as the “Washington Bureau Chief for hrforwar-s.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 


assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We farther assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
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services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
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emails were later post on DCLeaks, 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14,2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5,2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
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why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8,2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12,2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13,2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 


-7- 







Case l:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 19 of 56 


resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @Roger JStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1,2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. //WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Info wars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 
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31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
every thin g I know is through that channel of communications. I’m not implying 1 have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
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or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wilcileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikilealcs: “Ha! The more you Y'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStone Jr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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the founder of WikiLeaks. For example, on June 4,2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R. That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10,2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE,and Others Regarding 

Forthcoming Leaks 

41. On September 11,2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE’ s^^^^^ddress,^^^^^^^^^^^^^| On October 17, 
2017, Chief Judge Howell issued a search warrant for one of STONE’s^^^^ddresses. 

On or about December 19, 2017, Chief Judge Howell issued a search 

warrant for email account. On or about March 14, 2018, Chief Judge Howell 

issued a search warrant fdr STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 
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42. On or about May 15, 2016,^^^^^^mailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now-” CORSI responded, “I copied Roger 

Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18, 2016, CORSI emailed STONE 

with the title, “Roger - why don't you look this over before I send I believe that 
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will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
he exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke - 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5, 2016,^^^^^^^Jan associate of STONE’s, emailed 

STONE at^^^^^^^^^^^^^^fhe email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ^^^^^^^ubsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE. also stated 

that in 201told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told was joking and 

had not actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to to have “dined” with ASSANGE. For example, an associate of 
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STONE sent a text to STONE at approximately 3:3 8PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this aftemoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’S iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 

me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31,2016, CORSl emailed STONE at 
“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31,2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 



investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
^^^^^^^^^^^^^P‘Roger[,] Is NY Post going to the Pedesta [sic] stuff?” 

53. On or about September 24, 2016,^^|^^|emailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” wrote back, “Awaiting secret file. Explosive... Hope you are well. 
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Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, indicated this 

conversation concerned possible derogatory information he was trying to obtain from Turkey. 

54. On or about October 3, 2016, an associate of STONE emailed STONE at 
sked: “Assange — what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but lie doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

‘What was 

that tliis mor nin g???” STONE replied, “Fear. Serious security concern. He thinks they are going 


57. That same day, BANNON emailed STONE at 
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to kill Him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don’t think so BUT his lawyer is a big 

democrat.” 

58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

According to phone records at 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31d74714-8ce5-l le6-875e-2clbfe943b66_story.html 
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63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using “I expect 

that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM, an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

Iforwarded message to CORSI without comment. STONE 

does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

67. On or about October 8,2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 


usim 


68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

emailed Corsi asking him to “send me your best podesta links.” 


STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
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CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. 1 can give you in raw fornl the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

at both the 

lin e “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13,2016, CORSI emailed STONE at 
PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 

CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like^^^^^^sldmmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombanlcf.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Mctcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13,2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at with the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[J You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by^^^^^^^vith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u — just 
landed JFK - on Info wars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

the 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text The email read, “Yes[.j I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19,2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Mian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Axe you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’S Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21,2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21,2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26,2018 titled “Minority Views,” Democratic 
members of HPSCI published exceipts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That - 

Q: ~ was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtiuth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’...Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21,2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.J” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28,2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28,2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29,2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 


- 25 - 




Case l:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 37 of 56 


confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ .. . Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “1 don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.J Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98.. STONE and CREDICO continued to message each other on or about December l, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say 1 have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6,2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8,2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 

t 

25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13,2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary. 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 



5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 

threatened-dog-135911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING MICROSOFT 

115. In my training and experience, I have learned that Microsoft provides a variety of 
online services, including electronic mail (“email”) access, voice communications services such 
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as Skype, Windows Live services, cloud storage services such as OneDrive, and software 
development kit accounts, to the public. Subscribers obtain any of these types of accounts by 
registering with Microsoft. During the registration process, Microsoft asks subscribers to provide 
basic personal information. Therefore, the computers of Microsoft are likely to contain stored 
electronic communications (including retrieved and unretrieved email for email subscribers and 
information concerning subscribers and their use of email services, such as account access 
information, email transaction information, and account application information. In my training 
and experience, such information may constitute evidence of the crimes under investigation 
because the information can be used to identify the account’s user or users. 

116. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for a services account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

117. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on theit systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i. e ., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
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logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

118. In my training and experience, in some cases, account users will communicate 
directly with a service provider about issues relating to the account, such as technical problems, 
billing inquiries, or complaints from other users. Providers typically retain records about such 
communications, including records of contacts between the user and the provider’s support 
services, as well as records of any actions taken by the provider or user as a result of the 
communications. In my training and experience, such information may constitute evidence of the 
crimes under investigation because the information can be used to identify the account’s user or 
users. 

119. This application seeks a warrant to search all responsive records and information 
under the control of Microsoft, a provider subject to the jurisdiction of this court, regardless of 
where Microsoft has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic communications 
and any records or other information pertaining to the customers or subscribers if such 
communication, record, or other information is within Microsoft’s possession, custody, or control, 
regardless of whether such communication, record, or other information is stored, held, or 
maintained outside the United States. It is my understanding that Microsoft has access to email 
accounts with the top level domain .au, which is associated with Australia. 
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120. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email provider can show how and when the account was accessed 
or used. For example, as described below, email providers typically log the IP addresses from 
which users access the email account, along with the time and date of that access. By 
determining the physical location associated with the logged IP addresses, investigators can 
understand the chronological and geographic context of the email account access and use relating 
to the crime under investigation. This geographic and timeline information may tend to either 
inculpate or exculpate the account owner. Additionally, information stored at the user’s account 
may further indicate the geographic location of the account user at a particular time (e.g., 
location information integrated into an image or video sent via email). Last, stored electronic 
data may provide relevant insight into the email account owner’s state of mind as it relates to the 
offense under investigation. For example, information in the email account may indicate the 
owner’s motive and intent to commit a crime (e.g., communications relating to the crime), or 
consciousness of guilt (e.g., deleting communications in an effort to conceal them from law 
enforcement). 
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FILTER REVIEW PROCEDURES 

121. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a maimer consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

122. Based on the forgoing, I request that the Court issue the proposed search warrant. 

123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 


REQUEST FOR SEALING 


124. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



^"Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 




day of September, 2018. 



The Honorable Beryl A. Howell 
Chief United States District Judge 


- 35 - 



Case l:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 47 of 56 


ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following Microsoft accounts, 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation 
(“Microsoft”), a company headquartered in Redmond, Washington: 

This warrant also applies to information associated with the following Skype usernames 
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft 
Corporation, an electronic communication and/or remote computing service provider with 
headquarters in Redmond, Washington: 
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ATTACHMENT B 

I. Information to be disclosed by Microsoft 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Microsoft Corporation (hereinafter “the Provider”), regardless of whether 
such information is stored, held or maintained inside or outside of the United States, and including 
any emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date arid time at which each 
email was sent, and the size and length of each email; 

b. The contents of all Skype communications sent to or from the account, including 
videos, instant messages, group messages, and attachments, as well as the complete 
conversation history for the account; 

c. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

d. The types of service utilized; 
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which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 

associated with session times and dates, account status, alternative email addresses 

» 

provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1,2016 to the present, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, Randy any 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials,' foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 

i 

book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal tire whereabouts of such person(s); 
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j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts . of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection ILa. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED 
AT PREMISES CONTROLLED BY 
MICROSOFT CORPORATION 


Case: 1:18-sc-02920 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 27051b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Microsoft Corporation (“Microsoft”), an. electronic 
communication and/or remote computing services provider headquartered in Redmond, 
Washington, not to notify any other person (except attorneys for Microsoft for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 
1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard , 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d282, 287-89 (D.C. Cir. 1991). 
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2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States ... that-has jurisdiction over the offense being investigated.” 
18 U.S.C. § 271 l(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Microsoft provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Microsoft may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [mc] finds that there 
is reason to believe that notifying the customer or subscriber of the court order ox- 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Microsoft not to notify any other person (except attorneys for Microsoft for the purpose 
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U. S.C. 

§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 

18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq. 
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(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
Offenses”), in connection with efforts to compromise the networks of the Democratic National 
Convention (“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the 
email accounts of U.S. persons involved in the 2016 presidential election, followed by the public 
release of stolen materials through various outlets. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Microsoft and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Microsoft for the purpose of receiving 
legal advice) for a period of one year or until further order of the Court. Such an. order is 
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature 
of which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant 
and related papers may also alert the targets to the scope of information known to the FBI. Once 
alerted to this information, potential targets would be immediately prompted to destroy or conceal 
Incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Microsoft, the United States is aware that, absent a 
court order under Section 2705(b) commanding Microsoft not to notify anyone about a legal 
request, Microsoft may, upon receipt of a warrant seeking the contents of electronically stored wire 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Microsoft not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for Microsoft for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 


Dated: 


By: 


Respectfully submitted, 
ROBERT S. MUELLER, III 



(202)616-3812 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH TWO ACCOUNTS 
STORED AT PREMISES 
CONTROLLED BY GOOGLE 


) Case: 1:18-sc-02921 

^ Assigned To : Howell, Beryl A. 

) Assign. Date : 9/27/2018 
) Description: Search & Seizure Warrant 

) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)'. 


See Attachment A 


1 find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the properly to be seized): 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventoiy 

as required by law and promptly return this warrant and inventory to_ Hon. Beryl A. Howell, Chief U.S. Dist r ict Judge _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) ''' 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date bf .\ _. 

a' '• . • 

Date and time issued: _ 

Judge's signature 

City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date:___ ______ 

Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Google accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 
operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 


- 1 - 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703 (f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice in f ormation associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google-I- information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1,2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 

Julian Assange, or communications regarding disinformation, denial, dissembling 

) 

or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, dociunents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, ^^^^^^^^^^^Julian 
Assange, Randy 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any fluids or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user ’ s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access die account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Il.a. 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 


-7- 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 11 281B 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH TWO 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: 1:18-sc-02921 
Assigned To : Howell, Beryl A 

Assign. Date: 9/27/2018 

Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google, an electronic communication and/or remote computing services provider 
headquartered in Mountain View, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 


Date 



THE HONORABLE: 

CHIEF UNITED STATES DISTRICT JUDGE 


2 
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United States District Court 

for the 

District of Columbia 


FIL E 0 

SEP 2 1 


In the Matter of the Search of % 

(Briefly describe the property to be searched ) 

or identify the person by name and address) \ 

INFORMATION ASSOCIATED WITH < 

TWO ACCOUNTS STORED AT PREMISES < 

CONTROLLED BY GOOGLE ) 


Clerk, U.S. District & Bankruptcy 
GotTfa for tire District of Columbia 

Case: 1:18-sc-02921 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Northern _ District of __ California , there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
l?f evidence of a crime; 

i?f contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


Qf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:__) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 



Reviewed by AUSA/SAUSA: 
Kyle R. Freeny (ASC) 


Applicant’s signature 

Patrick J. Myers, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 

Date: _ ^ 

' Judge's signature 

City and state: Washingto n, D.C. _ Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 




Case l:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 13 of 57 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 

IN THE MATTER OF THE SEARCH OF Case' 1 ' 18-SC-02921 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

TWO ACCOUNTS STORED AT PREMISES Da , e . 9/27/20 18 

CONTROLLED BY GOOGLE _ Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


pfi pm 

□ gh Bo 


SEP 2 7 


Clerk, U.S. Diotrlct & Lkinkruptcy 
Courts for the District of Columbia 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
associated with the Google accounts registered to 

“Target Accounts 1 & 2”), stored at premises owned, maintained, 
controlled or operated by Google, LLC (“Google”), a company headquartered in Mountain View, 
Califonua i Assetfordibelow s theTargetAccoimtsB^^ ,,l ^ 9 ^®® fe, *^^**^ M ® 1 ? 8 ^®^»W itiRSw 

Upon receipt of the information 

described in Attachment A, government-authorized persons will review that information to locate 
the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities ofviolations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(l )(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) ... that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES, 
ii. Jerome CORSI 

7. Jerome CORSLis a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 



- 3 - 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 


Election 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-maii accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22,2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Tire article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8,2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at tire Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Weil, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13,2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17,2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21,2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStone Jr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Info wars that his intermediary 
described this release as the “mother load.” On October 5,2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7,2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour - later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27,2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any baclcchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13,2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you Y'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9,2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


1 On or about August 7,2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped 1 don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JuIianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE, 

Forthcoming Leaks 

41. On S eptember 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE’s ^^^^^iddress 

2017, Chief Judge Howell issued a search warrant for one of STONE’s^^^Jaddresses, 

On or about December 19, 2017, Chief Judge Howell issued a search 

warrant email account. On or about March 14, 2018, Chief Judge Howell 

issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On Or about May 15, 2016, emailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now....” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 




and Others Regarding 
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appears to have forwarded the message to STONE replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18,2016, CORSI emailed STONE at 

with the title, “Roger — why don't you look this over before I send it believe that 

^ COILS! wrole. 

L I___ iM an d I did manage to see Mr. Trump for a few minutes today as wc were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, usingsent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” 

On or 31, 2016, STONE, using emailed 

CORSI with the subject line, “Call me MON.” The body of the email read: should see 

AssangejV] should find Bernie [Sjanders brother who called Bill a Rapist - turn him for 

Trump[.] should find^^^^^^^^^or more proof of Bill getting kicked out.” 

46. On or about August 2,2016 (approximately 19 days before STONE publicly 

tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

‘Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke - 


neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSPs reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5,2016, 


an associate of STONE’s, emailed 


STONE at 


The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 


Julian Assange last night.’ 


ubsequently stated to investigators that, around the 


same time, STONE told him he had gone to London to meet ASSANGE. 


also stated 


that in 2018, 


told STONE he would be interviewed by the FBI and would have to 


divulge the conversation about meeting ASSANGE. STONE told 


he was joking and 


had not actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 


in his email to 


to have “dined” with ASSANGE. For example, an associate of 


STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this aftemoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
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call later-heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 . and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 
‘Give me a call today if you can. Despite MSM drumroll that HRC is 

already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31,2016, CORSI emailed STONE at 
‘Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31,2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
‘Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016,^^^^^^|einailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again to day. wrote back, “Awaiting secret file. Explosive... Hope you are well. 

Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators,indicated this 
conversation concerned possible derogatory information he was hying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 

asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4,2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE a1^^^^^^^^^^^^|“What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don’t think so BUT his lawyer is a big 

democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4,2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

According to phone records at approximately 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-lle6-875e-2clbfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE expect 

that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM, an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 

with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 

newly-released Podesta emails. Approximately ten minutes later, STONE, using 

^^^^^^^^^^^^^forwarded message comment. STONE 

does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

using^^^^^^^^^^^Hemailed Corsi asking him to “send me your best podesta links.” 

STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff 1 got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

STONE at both 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the^^^jAccount, “Got them and used them.” 

71. On or about Thursday, October 13,2016, CORSI emailed STONE at 

“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like^^^^^^kimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation!;.] [web link] 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at^^^^^^H^^|with the subject, “ROGER STONE article 
RUSSIAN MAMA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombanlc, a Russian regional bank owned 99.978 percent by^^^^^^Jwith the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
Intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.j I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. Fle’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikilealcs, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26,2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21,2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21,2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those exceipts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 

2017, STONE published an article on his website, stonecoldtrutli.com, titled “Is it the Podesta’s 

/ 

Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21,2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for peijuryf]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28,2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Faceboolc post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’... Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for peijury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of peijury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25,2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13,2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, Tm going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary. 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 



5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 

threatened-dog-135911370 .html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING GOOGLE 

115. In my training and experience, I have learned that Google provides a variety of on¬ 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 
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application information. In my training and experience, such information may constitute evidence 
of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

116. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

117. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(z'.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 
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118. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

119. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subj ect to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

120. As explained herein, information stored in comiection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
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lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

FILTER REVIEW PROCEDURES 

121. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

122. Based on the forgoing, I request that the Court issue the proposed search warrant. 
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123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

124. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 




day of September, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Google accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 
operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 
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f. 

g- 

h. 

i. 

J* 

k. 

L 

m. 

n. 

o. 

P- 

q- 

r. 

s. 

t. 


All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

All subscriber “change history” associated with the account; 

All search history and web history associated with the account; 

All location and maps information associated with the account; 

All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 
All Google Developers Console information associated with the account; 

All Minutemaid information associated with the account; 

All Android information associated with the account; 

All Google Docs associated with the account; 

All YouTube i nf ormation associated with the account; 

All Google Hangouts information associated with the account; 

All Google Voice information associated with the account; 

All Web & App Activity associated with the account; 

All Google Drive information associated with the account; 

All Google+ information associated with the account; 

All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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a. All records, information, documents or tangible materials that relate in any way to 
co mmuni cations regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 

I 

or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange, 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication: 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 


Randy Credico, any 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

It. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—-who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
• principals. 

n. . Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II. a. 1 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH TWO 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: 1:18-sc-02921 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. 8 2705fb) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mountain View, California, not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 


1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States ... that - has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part. Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 ... may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 


2 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [sic\ finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 

§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a 
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject Offenses”), in 
connection with efforts to compromise the networks of the Democratic National Convention 
(“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the email accounts 
of U.S. persons, followed by the public release of stolen materials through various outlets. 
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7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the investigation, and its disclosure may alert these 
targets to the nature, scope, and focus of the ongoing investigation. Disclosur e of the Warrant and 
related papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal, 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson , 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, 
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or 
electronic communications for a certain account, notify the subscriber or customer of the existence 
of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 


Dated: 9/2.-?/l?> 


Respectfully submitted, 


ROBERT S. MUELLER, III 
Special Counsel 
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i and Seizure Warrant 


/ United States District Court 

/ for the 

/ District of Columbia 

In the Matter of the Search of 

/ (Briefly describe the property to be searched 

or identify the person by name and address) 

INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY APPLE 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Northern _District of California 

(identify the person or describe the property to be searched and give its location): 


Case: 1:18-sc-02922 
Assigned To : Howell, Beryl A. 

Assign. Date: 9/27/2018 
Description: Search & Seizure Warrant 


i 



See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized ): 

See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 _ ( no t to exceed 14 days) 

Sf in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge _ 

(United States Magistrate Judge) 


□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for_days (not to exceed 30) □ until, the facts justifying, the later specific date of 


Date and time issued: 


*7/^rA/f a? 



Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: 


Washington, DC 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Case No.: 


Date and time warrant executed: I Copy of warrant and inventory left with: 


Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following accounts, which are 
stored at premises owned, maintained, controlled, or operated by Apple, Inc. (“Apple”), a company 
headquartered in Cupertino, California: 
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ATTACHMENT B 

I. Information to be disclosed by Apple 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Apple, Inc. (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including 
any emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the 
Provider is required to disclose the following information to the government for each account or 
identifier listed in Attachment A: 


a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and 

k. All telephone or instrument numbers associated with the Account (including MAC 
addresses. Electronic ' Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 


II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access ofaprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1,2016, to December 31,2017, including: 

a. All records, information, documents or tangible materials that relate in any way to 
. communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
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Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi^^^^^^^^^^^, Julian 

Randy Charles 

Ortel, or any individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-fisted offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 

v, 

foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
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i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II.a. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
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operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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Case l:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 9 of 57 


FILED 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


SEP 2 7 20)8 

Cl»rk, U.S, District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY APPLE, INC. 


Case: 1:18-sc-02922 
Assigned To : Howelf, Beryl A 
Assign. Date: 9/27/2018 
Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Apple, Inc., an electronic communication and/or remote computing services 
provider headquartered in Cupertino, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 
and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Apple and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 


Date 



THE HONORABLE 6£RYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 


2 
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AO 106 (Rev, 04/10) Application for a Search Warrant 


United States District Court 

for the 


FILED 

SEP 2 7 2018 


District ot Columbia Cltrk, U.S. District & Bankruptcy 

Courts (or the District of Columbla- 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY APPLE 


) Case: 1:18-sc-02922 

< Assigned To : Howell, Beryl A. 

) Assign. Date : 9/27/2018 

) Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

1, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property io be searched and give its location): 

See Attachment A 

located in the Northern _ District of__Ca lifornia _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
y( evidence of a crime; 

af contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add’! 

The application is based on these facts: 

See attached Affidavit. 


$ Continued on the attached sheet. 


a Delayed notice of_days (give exact ending date if more than 30 days: _) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 



Reviewed by AUSA/SAUSA: Applicant's signature 


Kyle R. Freeny (ASC) 


Patrick J. M yers, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 
Date: 



Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washingto n, D.C. 


Printed name and title 
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FILED 


IN THE UNITED STATES DISTRICT COURT SEP 2 7 2018 

FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY APPLE 


Cl»rk, U.8. District & Bankruptcy 
Courts for the District ol Columbia 

Case: 1:18-sc-02922 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 

information associated with the Apple account Account”), stored at 

premises owned, maintained, controlled or operated by Apple, Inc. (“Apple”), a company 
headquartered in Cupertino, California. As set forth below, the Target Account is believed to be 
used by an associate of STONE who was in communication with STONE on the day that 
WikiLeaks first released emails stolen from Clinton Campaign chair John Podesta and who appears 
to have met with STONE in October 2016 on the same day that STONE publicly claimed to have 
had dinner with his back-channel to WikiLeaks founder Julian Assange. Upon receipt of the 
information described in Attachment A, government-authorized persons will review that 
information to locate the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation {“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office, I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI persomiel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 
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PROBABLE CAUSE 
A, Background on Relevant Individuals 

i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015, Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORS1 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

1 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
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services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 


- 5 - 






Case l:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 17 of 57 


emails were later post on DCLeaks. 

17. On or about November 1,2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
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why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. 1 believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 

Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18,2016, Paul MANAFORT, STONE’s longtime friend and associate, 


- 7 - 



Case l:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 19 of 57 


resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... 1 think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 
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31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HUlaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account, 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything 1 know is through that channel of communications. I’m not implying I have any 
influence with him or that 1 have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Iluma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since 1 never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
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or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikiieaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 


1 On or about August 7,2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you l will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE,and Others Regarding 

Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 

a for STONE’s^^^^|address,^^^^^^^^^^^^^| On October 

2017, Chief Judge Howell issued a search warrant for one of STONE’^^^|addresses, 

or about December 19, 2017, Chief Judge Howell issued a search 

warrant email account. On or about March 14,2018, Chief Judge Howell 

issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 
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42. On or about May 15, 2016,CORSI: “Here is my flight 

schedule. Need to get something confirmed now .. ..” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18, 2016, CORSI emailed STONE 

with the title, “Roger — why don't you look this over before I send it to^^^^^|l believe that 
|Tr /;,-j_ ,v,., CORSI wrote, 

and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

On July STONE, usingan email to 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” The text of this email from STONE to CORSI substantially mirrored the 
text of aii email that STONE received from ^—a freelance blogger who had been 
conducting research into the Clintons during presidential campaign—on or about the same day. 

45. On or about July 31, 2016, STONE, using^^^^H^^^^Kmailed 

CORSI with the subject line, “Call me MON.” The body of the email read: should see 

Assange[.] should find Bemie [Sjanders brother who called Bill a Rapist — turn him for 

Trump[.] should find more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
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friend in embassy 2 more dumps. One shortly 

back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5, 2016, an associate of STONE’s, emailed 

STONE The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.”^^^^^|subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE.^^^^^^^lso stated 
that in 2018, told STONE he would be interviewed by the FBI and would have to 

divulge the conversation about meeting ASSANGE. STONE told was joking and 

had not actually met ASSANGE, 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
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suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to have “dined” with ASSANGE. For example, an associate of 

STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this aftemoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15,2016, CORSI emailed STONE at 

“Give me a today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31,2016, CORSI emailed STONE at 

you the PODESTA writeup.” STONE replied 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
^^^^^^^^^^^^^^^Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016, ailed CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
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secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” ^^^^^^Jwrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

54. On or about October 3, 2016, an associate of STONE emailed STONE at 
nd asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Barmon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release infonnation damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
infonnation previously referred to about the U.S. election process,” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4,2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 



indicated this 
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57. That same day, BANNON emailed STONE was 

that tills morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don’t think so BUT his lawyer^^^^l is a big 
democrat.” 

58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F, STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, 'Access Hollywood,’ and NBC for reaction.” 

at 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53 AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

3 https://www.washingtonpost.com/Iifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-lle6-875e-2clbfe943b66_story.html 
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62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using “I expect 

that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM,the person who originally suggested 

“getting] to Assange,” and who, according to emails and phone records, regularly 
communicated with STONE—sent STONE an email titled, “WikiLeaks - The Podesta Emails,” 
with a link to the newly-released Podesta emails. Approximately ten minutes later, STONE, 
using forwarded ^^^^^nessage to CORSI without comment. 

STONE does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 

Accused of Advance Knowledge of the Leak 

67. On or about October 8,2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok, I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 
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68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff 1 got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. ' On or about that same day, October 12,2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at botl 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 


i, with the subject 



“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 


CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS TIiIS[:] It looks to me 
like skimmed maybe billions off Skolkovo — Skolkovo kept their money with 

Metcombank[.] The Russians launched a criminal investigation^] [web link] Once 
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had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombankf.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13,2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email with the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “RogerfJ You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent with the money 

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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74. On or about October 17,2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u — just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

75. On or about October 17, 2016, CORSI emailed STONE at 

with the subject, “Fwd: 
very trusted source,” and forwarded an email 

with the header information stripped out, showing only the body text. The email read, “Yes[.j I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.] ’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
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my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8,2016, the United States presidential election took place. 

79. On or about November 9,2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger, He could not have done it without you.” 

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedIIillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12,2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
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Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 

89. In a document dated March 26,2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary - 
MR. STONE: That - 

Q: — was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19,2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
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lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoenaf.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24,2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
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27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29,2037, STONE publicly stated that CREDICO was his 
"intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British 1TV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ ... Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for peijury 
now[.]” STONE responded, "What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury [.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 

,.. you should go back ... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 

4 Contrary to his statement, CREDICO had not at the time provided any forensic evidence to the 
FBI. 
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you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs . .. + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’ll get 
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off because you’re friends with Trump so don’t worry. I have all the forensic evidence^] I was 
not a ba[ck] Channel and 1 have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie, You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

.. When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

105. As noted above, in late July 2016^^^^|emailed STONE to “get to Assange,” 
which appears to have precipitated STONE’s email to CORSI with the same instruction. 

106. On or about August 17, 2016^^^^^ sent an email to STONE’s Gmail account 
with the subject line, “Introduction.” The email was also sent to the work account 

5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 

6 https.7/www,motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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listed both STONEtelephone numbers, and he advised them, “You should find 
time to chat.” 

107. 1 oil records for STONE’s cellphone show that between August 18, 2016 and 

November 3, 20K^^^^^|was in contact with STONE approximately 60 times. This 
included several calls on October 7, 2016, the day that WikiLeaks began releasing Podesta’s 
emails. On that called STONE at approximately 12:33PM, within an hour of 

STONE’s call with the Washington Post, which was about to publish information about the 
“Access Hollywood” tape. The call lasted approximately seven minutes.appears to 
be the first person, other than journalists, to talk to STONE after STONE’s call with the 
Washington Pos^^^^^J called STONE a second time at approximately 2:38PM on the same 
day. That call lasted approximately one minute. STONE also had a missed FaccTime call from 

at approximately 3:32PM the same day. WikiLeaks released the first tranche of stolen 
Podesta emails approximately one hour later. 

108. As noted above^^^^^^^ told investigators that in January 2017, CORSI told 
him that he (CORSI) and STONE were involved in and were aware of the timing and content of 
the WikiLeaks releases in advance, including the fact that the emails belonged to John Podesta, 
and CORSI implied, in sum and substance, that STONE was involved in the release of the 
Podesta emails by WikiLeaks. 

109. According to open source information, on or about October 12, 2016, five days 
after the first release of stolen Podesta emails, STONE told a local news outlet in Florida, “I do 
have a back-channel communication with Assange, because we have a good mutual friend. That 
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friend travels back and forth from the United States to London and we talk. I had dinner with 
him last Monday.” 7 The Monday prior to the date of STONE’s statement was October 10, 2016. 

110. In the early hours of October 10, 2016, at approximately 3:26AM 

texted STONE: If you are still in NY we MUST meet tomorrow. Major major 

stuff.” At approximately 8:26AM the same day (but, effectively, the next morning, given the 
hour o^^’s text), STONE replied, “Ok - can we meet UES?” UES appears to be a 
reference to the Upper East Side of New York City, where STONE maintained a residence. 

texted STONE at approximately 9:02AM, “Sure. Lunch? Coffee? Time?” and again at 
10:55AM, “What time works.” Investigators have not located a response from STONE, although 
called STONE at approximately 4:45PM, with a call duration of approximately 4 

seconds. 

111. Cell-site location data for STONE shows that he was in the Upper East Side on 
the evening of October 10,2016, when he claimed to have met with his contact to Assange. 

for show 

transaction on October 10, 2016, at a pizza parlor located in the Upper East Side, in the amount 
of approximately $20. 

112. Search warrant returns show that after WikiLeaks began to release Podesta’s 
emails in October 2016,^^^^^ emailed STONE several times from the account 

Is' VfrVfmjYw/'■(“Target Account”) with links to WikiLeaks’ website and discussion about the 
W^^^^^W^ous Podesta emails that WikiLeaks had released. For example, on or about 
October 25, 2016, sent an email from the Target Account to STONE’^^^|account 

7 https://miami.cbslocal.com/2016/10/12/trump-ally-roger-stone-admits-back-channel-tie-to- 
wikileaks/ 


- 30 - 










Case l:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 42 of 57 


with a link to the portion of WikiLeaks’ website containing Podesta emails, with the comment, 
“Cheryl Mills & John Podesta panic to cover Obama’s lies on Hillary emails.” 

113. Search warrant returns for CORSi’^^^^Jk account show was in 

communication with CORSI at least in 2017. During an email exchange in June 2017 that 
appears to relate to financial policy-makers, CORSI tol^^^^^J that he was “concerned about 
Mueller,” following up shortly thereafter to clarify that had “meant Mnuchen,” the Secretary of 
Treasury. CORSI added, “Guess I have Special Counsel on mind these days.” 

114. For the foregoing reasons, there is probable cause to believe that the Target 
Account contains evidence, contraband, fruits, and/or instrumentalities of the Subject Offenses. 

BACKGROUND CONCERNING APPLE 

115. In my training and experience, I have learned that Apple provides a variety of on¬ 
line services, including electronic mail (“email”) access, to the public. Apple allows subscribers 
to obtain email accounts at the domain name me.com, like the Target Account. Subscribers obtain 
an account by registering with Apple. During the registration process, Apple asks subscribers to 
provide basic personal information. Therefore, the computers of Apple are likely to contain stored 
electronic communications (including retrieved and unretrieved email for Apple subscribers and 
information concerning subscribers and their use of Apple services, such as account access 
information, email transaction information, and account application information. In my training 
and experience, such information may constitute evidence of the crimes under investigation 
because the information can be used to identify the account’s user or users. 

116. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
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identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information, 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

117. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(/. e ., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

118. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
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evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

119. This application seeks a warrant to search all responsive records and information 
under the control of Apple, a provider subject to the jurisdiction of this court, regardless of where 
Apple has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Apple’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

120. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
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chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location infonnation 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

FILTER REVIEW PROCEDURES 

121. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

122. Based on the forgoing, I request that the Court issue the proposed search warrant, 

123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 

124. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



"Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 



day of September, 2018. 


_ 

The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the following accounts, which are 
stored at premises owned, maintained, controlled, or operated by Apple, Inc. (“Apple”), a company 
headquartered in Cupertino, California: 
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ATTACHMENT B 

I. Information to be disclosed by Apple 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Apple, Inc. (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including 
any emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the 
Provider is required to disclose the following information to the government for each account or 
identifier listed in Attachment A: 


a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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f. Ail search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and 

k. All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of aprotected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from June 1, 2016, to December 31, 2017, including: 

a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
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Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, Julian 

Assange,Randy Credico,^|^^^H 

any individual associated with the-Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
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i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II. a. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
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operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ONE 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY APPLE 


Case: 1:18-sc-02922 
Assigned To : Howell, Beryl A. 

Assign. Date: 9/27/2018 
Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 I J.S.C. 6 2705/bI 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Apple, Inc. (“Apple”), an electronic communication 
and/or remote computing services provider headquartered in Cupertino, California, not to notify 
any other person (except attorneys for Apple for the purpose of receiving legal advice) of the 
existence or content of the Warrant for a period of one year or until further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293,315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Postv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States... that —has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
-occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Apple provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§2701-2712, governs how Apple may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 .. . may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for .such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
.under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the . 
government makes the required showing under § 2705(b), the court is required to 
■ issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena HGJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Apple not to notify any other person (except attorneys for Apple for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The F ederal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S .C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
Offenses”), in connection with efforts to compromise the networks of the Democratic National 

Convention (“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the 
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email accounts of U.S. persons, followed by the public release of stolen materials through various 
outlets. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Apple and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the investigation, and its disclosure may alert these 
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and 
related papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under, investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
Longer needed, the Government will notify the Court and seek appropriate relief, 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
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§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government? s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Apple, the United States is aware that, absent a court 
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, Apple 
may, upon receipt of a warrant seeking the contents of electronically stored wire or electronic 
communications for a certain account, notify the subscriber or customer of the existence of the 

t 

warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
theretohnd other related materials be placed under seal, and furthermore, that the Court command 
Apple not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 

Respectfully submitted, 

ROBERT S. MUELLER, III 

Dated: /I ft By: 

i 

(202) 616-3812 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

\ Case: 1:18-sc-02994 

\ Assigned To : Howell, Beryl A. 

) Assign. Date : 10/5/2018 

) Description: USA v. SEALED 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Northern District of __ California 

(identify the person or describe the property to be searched and give its location)\ 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH FOUR 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


See Attachment A 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before Octob er 18, 201 8 _ (not to exceed 11 days) 

$ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. B eryl A. Howell, Chief U.S. D istrict J udge . 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) □ until, the facts justifying, the later specific date of __. 


Date and time issued: 





City and state; Washington, DC 


Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: __ __ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 

This warrant applies to information associated with the Google accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 
operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
inf o rmat ion to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google+ information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi,^^^^^^^^^^| Julian 
Assange, Randy any 

individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Co mmuni cations, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user ’ s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U. S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who co mm unicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II. a. 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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United States District Court oct -5 itri 


for the 

District of Columbia 


Clerk, U.S. District aiiu 
pankruptcy Courts 


) Case: 1:18-sc-02994 

Assigned To : Howell, Beryl A. 

) Assign. Date : 10/5/2018 

) Description: USA v. SEALED 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the_ Northern District of _ California _ _ , there is now concealed (identify the 

person or describe the property to be seized)\ 

See Attachment B 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATION ASSOCIATED WITH 
FOUR ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section Offense Description 

52 U.S.C. § 30121 Foreign Contribution Ban 

18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 

The application is based on these facts: 

See attached Affidavit. 


Iyf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: __) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 
Kyle R. Freeny (ASC) 



Patrick J. Myers, Special Agent, FBI 

Printed name and title 


Sworn to before me and signed in my presence. 
Date: 

City and state: Washington, D.C. _ 


Judge‘s signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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OCT -5 2018 

IN THE UNITED STATES DISTRICT COURTCIerk, U.S. District and 
FOR THE DISTRICT OF COLUMBIA bankruptcy Courts 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
FOUR ACCOUNTS STORED AT 
PREMISES CONTROLLED BY GOOGLE 


Case: 1:18-sc-02994 
Assigned To : Howell, Beryl A. 
Assign. Date: 10/5/2018 
Description: USAv. SEALED 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 
1. I make this affidavit in support of an application for a search warrant for 



of the information described in Attachment A, government-authorized persons will review that 
information to locate the items described in Attachment B. 


2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

.JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court). . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 
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PROBABLE CAUSE 
A. Background on Relevant Individuals 

i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 


assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
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services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
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emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
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why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his (documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if I can help u anyhow, it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
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resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a ‘“mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 
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31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account, 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references - argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 

I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
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or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you V'correctV me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 

E. CORSI’s Communications with STONE, and Others Regarding 

Forthcoming Leaks 

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE’s ^^^^|address,^^^^^^^^^^^^^^^| On October 
2017, Chief Judge Howell issued a search warrant for one of STONE’s^^^Jaddresses, 

On or about December 19, 2017, Chief Judge Howell issued a search 
warrant for email account. On or about March 14, 2018, Chief Judge Howell 

issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 
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42. On or about May 15, 2016,^^^^^^mailed CORSI: “Here is my flight 

schedule. Need to get something confirmed now . .. .” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at who replied to 

CORSI that, “May meet Manafort -guarantee nothing.” 

43. On or about May 18, 2016, CORSI emailed STONE at 

with the title, “Roger — why don't you look this over before I send it believe that 
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will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 

47. On or about August 5, 2016, an associate of STONE’s, emailed 

STONE at The email contained a link to a poll indicating that Clinton 

led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” subsequently stated to investigators that, around the 

same time, STONE told him he had gone to London to meet ASSANGE^^^^^^^J also stated 
that in 2018^^^^^^|told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told was joking and 

had not actually met ASSANGE. 2 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to to have “dined” with ASSANGE. For example, an associate of 
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STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later - heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 

“Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 

“ Did you get the P0DESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $ 180k to 
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution - Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
^^^^^^^^^^^^^|“Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016,^^^^^^^^mailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.”^^^^^^Rvrote back, “Awaiting secret file. Explosive... Hope you are well. 
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Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

54. On or about October 3, 2016, an associate of STONE emailed STONE at 

asked: “Assange - what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of hi m self. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE at “What was 

that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
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to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ Clintons???” STONE replied, “Don't think so BUT his lawyer a big 

democrat.” 

58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 

Are Released. 

59. According to a publicly available news article, 3 at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

to records at 

11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 

then-the-race-was-on/2016/10/07/3 Id74714-8ce5-l le6-875e-2clbfe943b66_story.html 
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63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE using “I expect 

that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 6:27PM, an author who has written about the 

Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks - The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

forwarded ^^^^Jmessage to CORSI comment. STONE 

does not appear to have forwarded the email to any other individual. 

G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 

67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed - 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 

using^^^^^^^^^^^^^Jemailed Corsi asking him to “send me your best podesta links.” 

STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
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CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 

at both with the 

line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-govemment money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via theAccount, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

“PODESTA - Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “Ell give you one more — NOBODY YET HAS THIS[:] It looks to me 
like ^^^^^Jskimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email at^^^^^^^^^vith the subject, “ROGER STONE article 

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,j You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a controversial Russian billionaire 

investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by^^^^^^^with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now - before 2pm[.]” STONE responded, “Missed u - just 
landed JFK - on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

the subject, “Fwd: 

ASSANGE.. .URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19,2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 
London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 

public what he said were his opening remarks to the committee. In them, STONE stated: 

Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny.... 

[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That- 

Q: - was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’S Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 

below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’.Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving - why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it - oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . .. Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1,2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.] 4 You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth ... You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . .. and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs . . . + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee .. . But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence^] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 

. . When you start bringing up my dog, you’re crossing the line[.]” 5 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too. 

He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 



5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 

threatened-dog-13 5911370.html 

6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERN INC GOOGLE 


117. In my training and experience, I have learned that Google provides a variety of on¬ 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 
application information. In my training and experience, such information may constitute evidence 
of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

118. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
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(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

119. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(z. e ., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

120. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 
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121. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

122. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
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exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g ., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

FILTER REVIEW PROCEDURES 

123. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

124. Based on the forgoing, I request that the Court issue the proposed search warrant. 

125. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
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REQUEST FOR SEALING 

126. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 



Patrick J. Myers 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on this 



of October, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Google accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 
operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 

j. All Google Developers Console information associated with the account; 

k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 

q. All Web & App Activity associated with the account; 

r. All Google Drive information associated with the account; 

s. All Google+ information associated with the account; 

t. All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 
period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, Theodore Malloch, Julian 
Assange, Mark Goldman, Mamadou Paye, Andrew Miller, Randy Credico, any 
individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

h The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection II. a. 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH FOUR 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: t:18-sc-02994 
Assigned To : Howell, Beryl A. 
Assign, Date: 10/5/2018 
Description: USA v. SEALED 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. 6 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non¬ 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mountain View, California, not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 


JURiSDICT l ON AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States . . . that - has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(l)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 

adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 

notification. In relevant part, Section 2705(b) provides as follows: 1 

(b) Preclusion of notice to subject of governmental access. — A governmental 
entity acting under section 2703 .. . may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 

requisite showing about potential consequences of notification: 

The explicit terms of section 2705(b) make clear that if a courts [szc] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a 
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject Offenses”), in 
connection with efforts to compromise the networks of the Democratic National Convention 
(“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the email accounts 
of U.S. persons, followed by the public release of stolen materials through various outlets. 
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7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the investigation, and its disclosure may alert these 
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and 
related papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, 
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or 
electronic communications for a certain account, notify the subscriber or customer of the existence 
of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 


Dated: \_Q l c b /\9> 


Respectfully submitted, 
ROBERT S. MUELLER, III 



(202) 616-3812 
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FILED 

OCT -5 2018 

IN THE UNITED STATES DISTRICT COURT District and 

FOR THE DISTRICT OF COLUMBIA Bankruptcy Courts 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH FOUR 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: 1:18-sc-02994 
Assigned To : Howell, Beryl A. 
Assign. Date : 10/5/2018 
Description: USAv. SEALED 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant ), 
and to require Google, an electronic communication and/or remote computing services provider 


headquartered in Mountain View, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 


interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 


warrant, the application and affidavit in support thereof, all attachments thereto and other related 


materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 



Case l:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 60 of 60 


IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 
further order of the Court. 


Date 


_ 

THE HONORABLE'''BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) Case: 1 : 19 — SW — 00057 

or- identify the person by name and address) ) Assigned To : Chief Judge Howell, Beryl A. 

VARIOUS ELECTRONIC devices belonging to ) Assign. Date : 2/13/2019 

ROGER J. STONE, JR. ) Description: Search and Seizure Warrant 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the __District of Columbia 

(identify the person or describe the property to be searched and give its location): 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before 
l?f in the daytime 6:00 a.m. to 10:00 p.m. "") at any time in the day or night because good cause has been established. 


February 27, 2019 


(not to exceed 14 days) 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to_Hon. Bery l A. Howell 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

FI for_days (not to exceed 30) □ until, the facts justifying, the later specific date of 


Date and time issued: 


City and state: Washington, DC_ _Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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ATTACHMENT A 


Property to be Searched 


The following devices provided to the FBI 



currently in the District of 


Columbia: 
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ATTACHMENT B 

Items to be seized from the Subject Devices 

1. The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 

a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 

b. Documents reflecting communications between Stone and Jerome Corsi; 

c. Documents reflecting communications between Stone and Randy Credico; 

d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, BHIlfi 
Paul Manafort, Richard Gates, and Donald J. Trump; 

e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 
the Federal Bureau of Investigation; 

f. Records and information relating to the e-mail accoun 

g. Records and information relating to the WhatsApp account associated with 
telephone number 

h. Records and information relating to the Signal account associated with telephone 
number 
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i. Records and information relating to the Wickr account associated with telephone 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and ownership 
of the computer systems, such as telephone records, notes, notebooks, diaries, and 
reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For any computer or storage medium whose seizure is otherwise authorized by this 
warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the things 
described in this warrant were created, edited, or deleted, such as logs, registry 
entries, configuration files, saved usernames and passwords, documents, browsing 
history, user profiles, email, email contacts, “chat,” instant messaging logs, 
photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to determine 
the chronological context of computer access, use, and events relating to crime 
under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime under 
investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 


for the 

District of Columbia 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

VARIOUS ELECTRONIC DEVICES BELONGING TO 
ROGER J. STONE, JR. 


FEB 1 3 2019 

U.vi, Disifici u ttefiKHipicy 

Courts for the of tntotnfo* • 


Case: 1:19-sw-00057 

Assigned To : Chief Judge Howell, Beryl A. 

Assign. Date : 2/13/2019 

Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that 1 have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location) : 

See Attachment A 

located in the_District of_ Columbia _, there is now concealed (identify the 

person or describe the property to be seized)’. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

M evidence of a crime; 

contraband, fruits of crime, or other items illegally possessed; 
af property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 

18U.S.C. § 1505 
18U.S.C. §1512 
18U.S.C. §1001 


Obstruction of Proceeding 
Witness Tampering 
False Statements 


Offense Description 


The application is based on these facts: 

See attached Affidavit. 

0 Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: 


Aaron Zelinsky (ASC) 


Applicant’s signature 

Curtis Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 
Date: 02/13/2019 



Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT y l0i A Oieirict a mmtfcv 
FOR THE DISTRICT OF COLUMBIA '°" rts for the Dls ^ct of Dolm4- 


IN THE MATTER OF THE SEARCH OF 
VARIOUS ELECTRONIC DEVICES 
BELONGING TO ROGER J. STONE, JR. 


Case: 1:19-sw-00057 

Assigned To : Chief Judge Howell, Beryl A 

Assign. Date : 2/13/2019 

Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

1. Curtis A. Heide, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

L I make this affidavit in support of an application for a search warrant for the 
following devices (the “Subject Devices”) associated with Roger J. Stone, Jr. (“Roger Stone”), 
described below and further in Attachment A, currently located in the District of Columbia: 

a. 

b. 

c. 

2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been since 2006. In the course of my duties, I have been responsible for investigating federal 
crimes and national security matters involving both counterintelligence and issues related to 
cybersecurity. 

3. Iam currently involved in the investigation into Roger J. Stone, Jr., (“Roger Stone”) 
and others known and unknown to the government, for the commission of unlawful activities in 
the District of Columbia, and elsewhere, including, but not limited to: (i) obstruction of 
proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false statements, in 
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violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, in violation of 
Title 18, United States Code 1512(b)(1) (collectively the “Specified Federal Offenses”). 

4. On January 24,2019, a Grand Jury in the District of Columbia indicted Roger Stone 
on seven counts: (i) obstruction of proceeding, in violation of Title 18, United States Code, Section 
1505 (Count 1); (ii) false statements, in violation of Title 18, United States Code, Section 1001 
(Counts 2-6) and; (iii) witness tampering, in violation of Title 18, United States Code 1512(b)(1) 
(Count 7). See United States v. Roger Jason Stone, Jr., 19-cr-18-ABJ, Dkt. 1. On January 29, 
2019, Roger Stone pled not guilty to the charges before Magistrate Judge Deborah A. Robinson. 

5. I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, and 
information provided to me by other law enforcement officers and technical experts. 

6. This affidavit is intended to show merely that there is sufficient probable cause for 
the requested warrant and does not set forth all of my knowledge about this matter. Unless 
specifically indicated, all conversations and statements in this affidavit are related in substance 
and part. Where I assert that an event took place on a particular date, 1 am asserting that it took 
place on or about the date specified. 

7. For the reasons set forth in this Affidavit, there is probable cause to believe that one 
or more of the Specified Federal Offenses have been committed by Roger Stone and others known 
and unknown to the government. Further, there is probable cause to believe that each of the Subject 
Devices have been used to facilitate the commission of one or more of the Specified Federal 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Specified Federal Offense may be present in each of the 
Subject Devices, as described further in Attachment B. 
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PROBABLE CAUSE 

A. Background on Relevant Individuals 

8. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of 
Donald J. Trump (“Trump Campaign”) until in or around August 2015, and subsequently 
maintained regular contact with and publicly supported the Trump Campaign through the 2016 
election. 

9. Julian Assange is the founder and director of WikiLeaks, which is publicly 
described as a non-profit organization that disseminates non-public information and classified 
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from 
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in 
London, United Kingdom. 

10. Jerome Corsi is a political commentator who worked with an online media 
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke regularly 
with Stone throughout the campaign, including about the release of stolen documents by 
WikiLeaks. 



12. Based on the investigation to date, Randy Credico was a radio host who has known 
Stone for more than a decade. In testimony before the U.S. House of Representatives Permanent 
Selection Committee on Intelligence (“HPSCI”) on or about September 26, 2017, Stone described 
Credico (without naming him) as an “intermediary,” “go-between,” and “mutual friend” to 
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified Credico by 
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name and claimed Credico was the “gentleman who confirmed for Mr. Stone” that Assange, had 
“‘[e]mails related to Hillary Clinton which are pending publication.’” 

13. Richard Gates is a U.S. citizen who served for years as a political consultant and 
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates 
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates 
pled guilty to one count of conspiracy against the United States and one count of making false 
statements to federal law enforcement officers. United States v. Gates, 1:17-cr-201 (D.D.C.). 


14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in 
or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the chief 
executive officer of the Trump Campaign. 



B. Hacking Activity During the 2016 Presidential Election 


16. John Podesta is a U.S. citizen who served for years as a political consultant. During 
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary 
Clinton presidential campaign (“Clinton Campaign”). On or about March 24, 2016, Podesta 
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the 
email was recovered by the FBI from a subsequent release of stolen emails, described below). 
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving 


1 In my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 
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the email, his assistant (who also had access to the account) clicked on a link within the email and 
entered the account password when prompted (believing this prompt to be part of a security 
protocol). Based on my training and experience, this activity appears to have been a successful 
spearphishing operation, through which an actor would have gained access to Podesta’s email 
account, allowing the actor to steal emails and documents from that account. 

17. The Democratic National Committee (“DNC”) and Democratic Congressional 
Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal elections. 
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016 
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special 
Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became aware that their 
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity 
company CrowdStrike to investigate the intrusions and remediate. 

18. On or about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred to 
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “[b]oth adversaries 
engage in extensive political and economic espionage for the benefit of the government of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

19. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 
conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
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DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the 
Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s military 
intelligence agency. 

C. WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 

20. As alleged in the Netyksho indictment, after successfully hacking the DNC and 
DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the stolen 
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the 
transfers using online personas created by the GRU, including “Guccifer 2.0” and “DCLeaks.” 
(GRU officers separately used these personas to release some of the stolen documents). 

21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents 
stolen from the DNC network. These stolen documents included communications by senior DNC 
officials about campaign strategy, financial and fundraising data, and other documents related to 
the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

22. Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. 

D. Stone’s Communications About WikiLeaks During the Campaign 

23. In April 2018 interviews with the Special Counsel’s Office, Richard Gates stated 
that starting in or around May 2016, when Gates was a senior official on the Trump campaign, 
Stone informed members of the Trump Campaign that WikiLeaks had emails from then-candidate 
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by 
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WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed 


WikiLeaks and Stone’s prediction of the release. 

24. According to Gates, Manafort directed Gates to contact Stone about any additional 
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates 


contacted Stone, who made statements claiming that there would be potential future releases of 


damaging material by WikiLeaks. In a separate interview with the Special Counsel’s Office in or 
around October 2018, Gates recalled that at one point during the campaign he was with then- 
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing 
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming. 

25. Emails recovered through a court-authorized search of Stone’s email account 
show that shortly after the July 22, 2016 release of stolen DNC emails 
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 



a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 
line, “Get to Assange.” The body of the message read, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they 
deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 



2 A search of 


as authorized on or about September 11, 2017 by the U.S. 


District Court fo^h^istric^^olumbia. Case No. l:17-mj-661 (D.D.C. Sept. 11, 2017). A 
second search of was authorized on or about August 3, 2018 by the U.S. 

District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or 
about September 26, 2018, the govemmen^btaine^n^xecuted an order pursuant to 18 U.S.C. 
§ 2703(d) for records connected Case No. 1:18-sc-2911 (D.D.C. Sept. 

26, 2018). Records provided in respons^^Microso^Corporation confirmed that the account 
was still active and that the relevant emails described in this affidavit were not deleted from the 
account. 
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Stone’s email to 



who lived in the United Kingdom and who was a 


supporter of the Trump Campaign. 

b. On or about July 31, 2016, Stone emailed Corsi with the subject line, “Call me 



MON.” The body of the email read in part that 


'should see Assange.” 


c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he 
was currently in Europe and planned to return in mid-August. Corsi stated, “Word 
is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. 
Impact planned to be very damaging.” In a law enforcement interview, Corsi stated 
that the phrase “friend in embassy” referred to Assange. Corsi added in the same 
email, “Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC. That appears to be the game hackers are now about. Would 
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she 
well. I expect that much of next dump focus, setting stage for Foundation debacle.” 


26. According to recorded public statements recovered by the FBI, starting in early 
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 
statements about information he claimed to have learned from Assange: 


a. According to a public video posted to YouTube, on or about August 8, 2016, Stone 
attended a public event in Broward County, Florida. During the event, Stone stated, 
“I actually have communicated with Assange. I believe the next tranche of his 
documents pertain to the Clinton Foundation, but there’s no telling what the 
October surprise may be.” 

b. According to a public video posted to YouTube, on or about August 12,2016, Stone 
was interviewed for a video segment on the show InfoWars, hosted by Alex Jones. 
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During the interview. Stone stated that he was “in communication with Assange’* 
but was “not at liberty to discuss what I have.” 

c. According to a public video posted to YouTube, on or about August 16,2016, Stone 
stated during another interview with Alex Jones that “it became known on this 
program that I have had some back-channel communications with WikiLeaks and 
Assange.” In a second interview on or about the same day with Dana Loesch of 
the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and that 
they had a “mutual acquaintance who is a fine gentleman.” 

d. According to a video posted to the public website of the TV station C-SPAN, during 
a C-SPAN television interview on or about August 18, 2016, Stone stated that he 
had communicated with Assange through an “intermediary, somebody who is a 
mutual friend.” 

e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 

interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
the interview, Credico asked Stone, “You’ve been in touch indirectly with Assange. 
Can you give us any kind of insight? Is there an October surprise happening?” 
Stone responded, “Well, first of all, I don’t want to intimate in any way that I control 
or have influence with Assange because I do not. ... We have a mutual friend, 
somebody we both trust and therefore I am a recipient of pretty good information.” 
In or around November 2018, Stone 

produced a series of text messages between Stone and Credico during the 2016 presidential 
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campaign. 3 These text messages show that, beginning on or about August 19, 2016, Stone 
exchanged written communications with Credico about what WikiLeaks and Assange planned to 
do. Emails recovered through a court-authorized search of Stone’s email account 

'\\ additional urittcn communication^ between Stone and Credico 

about WikiLeaks in or around September 2016. 

a. On or about August 19,2016, Credico sent a text message to Stone that read in part, 
“I’m going to have Julian Assange on my show next Thursday.” On or about 
August 21, 2016, Credico sent another text message to Stone, writing in part, “I 
have Julian Assange on Thursday so I’m completely tied up on that day.” 

b. On or about August 25, 2016, Assange was a guest on Credico’s radio show for the 
first time. On or about August 26, 2016, Credico sent a text message to Stone that 
stated, “Assange talkjed] about you last night.” Stone replied and asked what 
Assange said, to which Credico responded, “He didn’t say anything bad we were 
talking about how the Press is trying to make it look like you and he are in cahoots.” 

c. On or about August 27, 2016, Credico sent text messages to Stone that said, “We 
are working on a Julian Assange radio show,” and that he (Credico) was “in charge” 
of the project. In a text message sent later that day, Credico added, “Julian Assange 
has kryptonite on Hillary.” 

d. On or about September 18,2016, Stone sent a text message to Credico that said, “I 
am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 


3 As discussed below. Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 
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added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

e. Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 
State. Stone stated, “Please ask Assange for any State or HRC e-mail from August 
10 to August 30 - particularly on August 20, 2011 that mention [the subject of the 
article] or confirm this narrative.” 

f. On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message ... to Assange.” Credico responded, “I did.” On or about September 20, 
2016, Credico forwarded the request to a close friend who was an attorney with the 
ability to contact the Assange. Credico blind-copied Stone on the forwarded email. 

g. On or about September 30,2016, Credico sent Stone via text message a photograph 
of Credico standing outside the Ecuadorian Embassy in London where Assange 
was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday ... now pretend u don’t know me ... 
Hillary’s campaign will die this week.” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4, 2016, which was reported to be the 10-year anniversary 
of the founding of WikiLeaks. 
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i. On or about October 2, 2016, Stone emailed Credico, with the subject line “WTF?” 
and a link to an article at the website http://heatst.com/politics/october-surprise- 
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to- 
security-concerns. Credico responded to Stone, “head fake.” 

j. On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off.” Credico initially responded, “I can’t tal[k] about it.” After 
further exchanges with Stone, Credico responded, “I think it[’]s on for tomorrow.” 
Credico added, “Off the Record Hillary and her people are doing a full-court press 
they [s/c] keep Assange from making the next dump ... That’s all I can tell you on 
this line ... Please leave my name out of it.” 

28. Emails and text messages recovered by the FBI show that, in or around October 
2016, Stone made statements about Assange’s future releases that were similar to prior statements 
made by Credico to him. For example: 

email account the 

FBI recovered an email from Stone to ^^Jsent on or about October 3, 2016, 
which stated in part, “Spoke to my friend in London last night. The payload is still 
coming.” 

b. In court-authorized search ofFBI also recovered an 
email exchange from on or about October 3, 2016 between Stone and a reporter 
who had connections to Bannon. In the exchange, the reporter asked, “Assange - 

4 A search of authorized on or about October 17, 2017 by the U.S. 

District Court for d ^ _^dumb ia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A 
second search of authorized on or about August 3, 2018 by the U.S. 

District Court for the District of Columbia. Case No. l:18-sc-2583 (D.D.C. Aug. 3, 2018). 
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what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell Bannon but he 
doesn’t call me back.” 

c. On or about October 4, 2016, Assange held a press conference but did not release 
any new materials pertaining to the Clinton Campaign. In a court-authorized search 
0 ^^^^^^, the FBI recovered an email exchange between Stone and 
Steve Bannon on or about October 4, 2016 that occurred after the press conference. 
In the exchange, Bannon asked, “What was that this morning???”, referring to 
Assange’s press conference. Stone responded, “Fear. Serious security concern. He 
thinks they are going to kill him and the London police are standing do[wn]. 
However - a load every week going forward.” 

d. In a court-authorized search of Stone’s iCloud account, 5 the FBI recovered text 

messages between Stone an^^^| from on or about October 4, 2016. In one text 
message^^^J asked Stone if he had “hear[d] anymore from London.” Stone 
replied, “Yes - want to talk on a secure line - got Whatsapp.” In an interview with 
the Special Counsel’s Office in or around May 20 confirmed that he and 

Stone spoke and that Stone had told him WikiLeaks had more material to release, 
and that the material was related to senior people associated with Clinton. 

29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen from 
Podesta. According to text messages recovered from Stone’s iCloud account, shortly after the 
release, an associate of Bannon sent a text message to Stone that read “well done.” Similarly, 


5 A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. l:18-sc-662 (D.D.C. Mar. 14, 2018). The 
records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 
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during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, 
Stone said, “I told you this was coming.” 

E. Stone’s Communications with the House Permanent Select Committee on Intelligence 

30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 
allegations of Russian interference in the 2016 presidential election and possible links to 
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about 
March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 
were of interest to the committee. 

31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily appear 

before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was 

recovered by the FBI from a court-authorized search of Stone’s email account 

players02@gmail.com). The letter requested Stone produce: 

Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's publicly- 
announced parameters. 

32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and 
stated that “Mr. Stone has no documents, records, or electronically stored information, regardless 
of form, other than those widely available that reasonably could lead to the discovery of any facts 


6 On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (“SSCI”) announced the committee would conduct an inquiry that would 
investigate, among other things, any intelligence regarding links between Russia and individuals 
associated with political campaigns, as well as Russian cyber activity and other “active measures” 
directed against the United States in connection with the 2016 election. 
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within the investigation’s publicly-announced parameters.” (A copy of the letter was recovered 
from a court-authorized search of Stone’s email account 

F. Stone’s Testimony Before HPSCI 

33. On or about September 26, 2017, Stone provided HPSCI with an “opening 
statement” that his counsel requested be included as part of the record of proceedings before 
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, 7 Stone 
stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 
responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” 


34. Also on or about September 26, 2017, Stone provided testimony in a closed session 
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was transcribed, and a 
copy of the transcript was obtained by the Special Counsel’s Office from HPSCI in or around 
December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he 
would tell the truth. At the beginning of the hearing, Stone was admonished that “it is unlawful to 
deliberately provide false information to Members of Congress or staff’ and that “providing false 
information to this committee or concealing material information from this committee is a crime 
punishable by law.” 

Stone’s Testimony About Documents He Possessed Related to WikiLeaks 

35. During his HPSCI testimony, Stone was asked about HPSCI’s May 2017 document 


7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence from Stone’s counsel to members of HPSCI. 
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request and whether Stone had any documents or written communications that discussed Julian 
Assange, Russian interference, or other relevant documents: 

Q: The committee wrote to you on May 9th requesting no later 

than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation. 

You wrote back through counsel that you had no documents, 
records, or electronically stored information regardless of 
form responsive to our requests. Was that a false statement? 

A: That is not a false statement. That’s what — I believe that to 

be true. 

[...] 

Q: So you have no emails to anyone concerning the allegations 

of hacked documents or your conversations with the 
Guccifer 2[.0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 

A: That is correct. Not to my knowledge. I think we met, again, 

the precise criteria of your request, and we complied. Again, 
if you have a more specific request, I'm happy to go back and 
look.... 

Q: I just want to ask you under oath - 

A: We did an extensive search consistent with the direction of 

my attorneys, and we found nothing that met the criteria that 
you asked for. 

Q: I just want to be certain because you are under oath, where 

your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange or 
Guccifer 2[.0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've written 
no documents yourself. 

A: In connection with Russian collusion, consistent with your 

exact and precise request, yes. 

36. In fact, and as described above, Stone had sent and received numerous emails and 
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 
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WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 

(including and 

at the time of his testimony. Stone was still in possession of many of these emails and text messages 
at the time he testified on or about September 22, 2017. 8 These written communications included 
(a) Stone’s email to Corsi on or about July 25, 2016 that read in part, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they deal with 
Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31,2016 that^^^H“should 
see Assange”; (c) Corsi’s email to Stone on or about August 2, 2016 that stated in part, “Word is 
friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. Impact planned 
to be very damaging.”; (d) dozens of text messages and emails between Stone and Credico, 
beginning on or about August 19, 2016 and continuing through duration of the election, in which 
they discussed WikiLeaks and Assange; (e) Stone’s email to^^Hon or about October 3, 2016 
that read in part “Spoke to my friend in London last night. The payload is still coming.”; and (f) 
Stone’s email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release “a 
load every week going forward.” 

Stone ’s Testimony. About His Early August 20J_6 Statements 
37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to 
explain his statements in early August 2016 about being in contact with Assange. Stone was 
specifically asked about his statement on or about August 8, 2016 that “I’ve actually 


8 The warrant for Stone’s email accountobtained on or about 
September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account 
was active and not deleted from the account. The warrant for Stone’s 

email account obtained on or about October 17, 2017 and executed 

shortly thereafter. The warrant for Stone’s iCloud account (which contained the text messages 
described above) was obtained on or about March 14, 2018 and executed shortly thereafter. 
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communicated with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

38. Stone testified that these public references to having a means of contacting 
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 
between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 
name of this “intermediary,” but he provided a description in his testimony that was largely 
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr. Stone” that 
Assange had “‘[ejmails related to Hillary Clinton which are pending publication.’”). 

39. In fact, documents recovered during the investigation (including those obtained via 

search warrant returns show that Stone did not begin communicating 

with Credico about Assange or WikiLeaks until on or about August 19, 2016 9 —approximately 
eleven days after Stone first claimed on or about August 8, 2016 to “actually have communicated 
with Assange” and a week after his August 12, 2016 statements of being “in communication with 
Assange” and “not at liberty to discuss what I have.” 

40. When interviewed by the FBI, Credico stated that the first time he ever spoke with 
Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico also 
provided the FBI with partially redacted emails that he claimed were between him and another 


9 As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25,2016, Credico 
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted 
Stone that “Assange has kryptonite on Hillary.” 

10 Credico was first interviewed by the FBI in or around August 2018. He has subsequently 
participated in multiple voluntary interviewsHMMMH(HHH|H[||^HMH^^HH||H 
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member of WikiLeaks from on or about August 25, 2016, in which the two discuss the technical 
logistics for the interview later that day. During the exchange, Credico offered biographical 
information about himself, apparently as a means of introduction. 

41. The FBI has not identified any communications between Stone and Credico from 
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed 
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks. 

42. In contrast, and as described above, the FBI has identified written communications 
prior to August 8, 2016 in which Stone directed Corsi—not Credico—to contact Assange. On or 
about July 25, 2016, for example, Stone wrote to Corsi, “Get to Assange [a]t Ecuadorian Embassy 
in London and get the pending WikiLeaks emails . . . they deal with Foundation, allegedly.” 
Similarly, on or about August 2, 2016, Corsi—not Credico—sent an email to Stone in which Corsi 
wrote that “[w]ord is friend in embassy plans 2 more dumps,” including one in October. These 
communications occurred days before Stone’s first public statement on or about August 8, 2016 
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to 
HPSCI as another individual Stone contacted to serve as a “go-between,” “intermediary,” or other 
source for information from WikiLeaks. Similarly, Stone also never disclosed his written 
communications with Corsi to HPSCI when answering HPSCI’s questioning about the August 8, 
2016 and August 12, 2016 statements about being in communication with Assange. 

Stone’s Testimony About Communications, to Assange 

43. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 
communicate anything else to Assange?” Stone responded, “I did not.” Stone was then asked, 
“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 
not.” 
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44. In fact, starting on or about September 18, 2016, Stone directed Credico to pass on 
a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 



According to text messages obtained 


on or about 


a. 


September 18, 2016, Stone sent a text message to Credico that said, “I am e-mailing 
u a request to pass on to Assange.” On or about the same day, Stone emailed 
Credico an article with allegations against then-candidate Clinton related to her 
service as Secretary of State. Stone added, “Please ask Assange for any State or 
HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that 
mention [the subject of the article] or confirm this narrative.” (A copy of this email 
was obtained through a search of Stone's email account 
b. According obtained on about 

September 19, 2016, Stone texted Credico again, writing “Pass my message ... to 
Assange.” Credico responded, “I did.” An email obtained from the account 



shows that on or about September 20, 2016, Credico 


forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 


Stoners Testimony About Written Communications with Credico 
45. During his HPSCI testimony, Stone was asked repeatedly about his 
communications with the person he identified as his intermediary. Stone stated that he had never 
communicated with his intermediary in writing in any way. During one exchange, Stone claimed 
only to have spoken with the intermediary telephonically: 

Q: [H]ow did you communicate the intermediary? 

A: Over the phone. 
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Q: And did you have any other means of communicating with 

the intermediary? 

A: No. 

Q: No text messages, no - none of the list, right? 

A: No. 

Later during his testimony. Stone again denied ever communicating with his intermediary in 
writing: 

Q: So you never communicated with your intermediary in 

writing in any way? 

A: No. 

Q: Never emailed him or texted him? 

A: He’s not an email guy. 

Q: So all your conversations with him were in person or over 

the phone. 

A: Correct. 

46. As described above, Stone and Credico (whom Stone identified as his intermediary) 
engaged in frequent written communication by email and text message. Beginning on or about 
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico 
engaged in dozens of communications by email or text message in which they discussed 
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton 
Campaign. 

47. Written communications between Stone and Credico continued up until Stone’s 
HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 
Stone testified before HPSCI and denied having ever sent or received emails or text messages from 
his identified intermediary—Stone and Credico exchanged over thirty text messages. 

48. Certain of the electronic messages between Stone and Credico (which Stone denied 
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ever taking place or possessing) would have been material to HPSCI, including Stone’s messages 
in or around September 2016 directing Credico to pass a request for documents to Assange, and 
other relevant written communications with Credico. For example, on or about January 6, 2017, 
Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony, 
that had the subject line “Back channel bs.” In the email, Credico wrote, “Well 1 have put together 
timelinesf] and you [] said you have a back-channel way back a month before 1 had Assange on 
my show ... I have never had a conversation with Julian Assange other than my radio show ... I 
have pieced it all together ... so you may as well tell the truth that you had no back-channel or 
there’s the guy you were talking about early August.” (A copy of this email was obtained through 
a accoun^^^^^^^^^^^^Ji). 

Stone’s Testimony, About Communications, with the Trump Campaign 
49. During his HPSCI testimony. Stone was asked, “[d]id you discuss your 

conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above. Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 
including the following: 

a. As described above. Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials by telephone to inform them about materials possessed 
by Assange and the timing of future releases. 

b. According to text messages on or about October 

3, 2016, Stone wrote to “Spoke to my friend in London last night. The 

payload is still coming.” 
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c. As described above, on or about October 4, 2016, after receiving information from 
Credico about the delay in WikiLeaks’s release of stolen materials, Stone emailed 
Bannon that Assange had a “[s]erious security concern” but would release “a load 
every week going forward.” 

G. Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 

50. According to an email recovered through a court-authorized search of Stone’s email 
accoun^^^^^^^^^^^^J on or about October 19, 2017, Stone sent Credico an excerpt of 
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his “intermediary” to 
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he 
should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged 
effort to prevent Credico from contradicting Stone’s false statements to HPSCI. 


51. In or around November 2017, Credico received a request from HPSCI to testify 
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 
repeatedly with Stone. 



see him. Stone responded, “‘Stonewall it. Plead the fifth. Anything to save the 
plan’ ... Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 
interview. 
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b. 


c. 


d. 


e. 


On or about November 21, 2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be getting a subpoena.” Stone 
responded, “That was the point at which your lawyers should have told them you 
would assert your 5th Amendment rights if compelled to appear.” (A copy of these 
text messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

On or about November 28, 2017, Credico received a subpoena compelling his 
testimony before HPSCI. Credico informed Stone of the subpoena. 

According to emails recovered from Stone’s email accountH^H|H|HH[^^H 


on or about November 30, 2017, Stone asked Corsi to write publicly about Credico. 
Corsi responded, “Are you sure you want to make something out of this now? Why 
not wait to see what [Credico] does? You may be defending yourself too much - 
raising new questions that will fuel new inquiries. This may be a time to say less, 
not more.” Stone responded by telling Corsi that Credico “will take the 5th—but 
let’s hold a day.” 

According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
II, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.” When interviewed 
by the FBI, Credico confirmed that he understood Stone’s references to Frank 
Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
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from investigators. 

f. On or about December 1, 2017, Stone texted Credico, “And if you turned over 
anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You need 
to amend your testimony before 1 testify on the 15th.” Stone responded, “If you 
testify you’re a fool. Because of tromp I could never get away with a certain [s/c] 
my Fifth Amendment rights but you can. I guarantee you you are the one who gets 
indicted for perjury if you’re stupid enough to testify.” (A copy of these text 
messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

52. On or about December 12,2017, Credico informed HPSCI that he intended to assert 
his Fifth Amendment privilege against self-incrimination if required to appear by subpoena. 
According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing 
evidence that would show Stone’s previous testimony to Congress was false. 

53. Following Credico’s invocation of his Fifth Amendment privilege not to testify 
before HPSCI, Stone and Credico continued to have discussions about the various investigations 
into Russian interference in the 2016 election and what information Credico would provide to 
investigators. During these conversations. Stone repeatedly made aggressive statements intended 
to prevent Credico from cooperating with the investigations. For example: 

a. On or about December 24, 2017, Credico texted Stone, “I met assange for f[i]rst 
time this yea[r] sept 7 ... docs prove that... You should be honest w fbi... there 
was no back channel ... be honest.” Stone replied approximately two minutes 
later, “I’m not talking to the FBI and if your smart you won’t either.” (A copy of 
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these text messages was recovered through a court-authorized search of Stone’s 
iCloud account). 

b. On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. You 
are a stoolie. You backstab your friends—run your mouth my lawyers are dying 
Rip you to shreds.” Stone also said he would “take that dog away from you,” 
referring to Credico’s dog. On or about the same day, Stone wrote to Credico, “I 
am so ready. Let’s get it on. Prepare to die [expletive].” (A copy of this email 
exchange was recovered through a court-authorized search of Stone’s email 

c. On or about May 21, 2018, Credico wrote in an email to Stone, “You should have 
just been honest with the house Intel committee ... you’ve opened yourself up to 
perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
You got nothing. Keep running your mouth and I’ll File a bar complaint against 
your friend [the attorney who had the ability to contact the head of Assange].” (A 
copy of this email exchange was recovered through a court-authorized search of 


Stone’s email accour 


l). Credico believed Stone knew that 


Credico was sensitive to having this friend’s name publicly disclosed. 

H. Missing Electronic Communications and Stone’s Use of Encrypted Communications 
54. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations into 
Russian interference in the U.S. election). However, the government is aware of the existence of 
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numerous other relevant electronic communications, the content of which it has not yet been able 
to recover. 

55. As described above, during his HPSCI testimony. Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 
Credico). In fact, emails and text messages recovered in this investigation show the two 
communicated frequently by email and text messages; court-authorized searches of Stone’s email 
and iCloud accounts confirm that Stone still had those communications at the time he testified in 
or around September 2017. In numerous communications. Stone and Credico discussed Julian 
Assange and WikiLeaks, as well as Stone’s suggestion that Credico was his intermediary to 
Assange. These communications appear relevant and responsive to HPSCI’s inquiry, but Stone 
never disclosed them. 

56. In addition to these emails and text messages in the FBI’s possession, the FBI has 
reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017, and 
they show text message communications whose content that the government to date has not been 
able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 
2016 and December 2017) the substance of which the government to date has not recovered or 
reviewed. The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after media 
reports in November 2018 stated that Stone’s attorneys were able to extract text messages between 
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have, 
for the same time period, many of Stone’s other text messages. The government seeks these text 
messages believing they may show additional evidence of (1) the falsity of Stone’s HPSCI 
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testimony concerning his communications with his “intermediary” and (2) efforts to corruptly 
persuade Credico not to cooperate with pending investigations. As discussed further below, the 
government has reason to believe that these messages may be located on the Subject Devices. 

57. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed 
that Stone has used encrypted applications to communicate with others. Similarly, records 
obtained in this investigation indicate Stone uses multiple applications designed for encrypted 
communication, including (a) WhatsApp, 11 (b) Signal, 12 (c) Wickr, 13 and (d) ProtonMail. 14 To 
date, the FBI has not obtained any of Stone’s communications conducted through these 
applications. 


11 According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default message 
application. 

12 According to open sources, Signal is an encrypted communications application allowing the user 
to send one-to-one and group messages, which can include files, voice notes, images and videos, 
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as 
identifiers, and uses end-to-end encryption to secure all communications to other Signal users. 
Signal also allows users to set timers to messages, after which the messages will be deleted from 
both the sender’s and the receivers’ devices. 

13 According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting user 
data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 

According to open sources, ProtonMail is an end-to-end encrypted email service that uses client- 
side encryption to protect email contents and user data before they are sent to ProtonMail servers. 
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the 
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and 
EU jurisdiction. 
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a. According to records from Stone’s iCloud account, a copy of the WhatsApp 
application was downloaded to an iPhone registered to Stone on or about October 
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 
email tc^^^^^^^that they “talk on a secure line” and proposed using WhatsApp. 

b. According to records from Stone’s iCloud account, a copy of the Signal application 
was downloaded to an iPhone registered to Stone on or about August 18, 2016. 
Additionally, text messages recovered from Stone’s iCloud account revealed that 
on or about November 15, 2016, Stone sent an attorney with the ability to contact 
Julian Assange a link to download the Signal application. 15 Approximately fifteen 
minutes after sending the link, Stone texted the attorney, “I’m on signal just dial 
my number.” The attorney responded, “I’ll call you.” 

c. According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 
2016. 

d. According to records from Stone’s iCloud account, a copy of the Wickr application 
was downloaded to an iPhone registered to Stone on or about August 5, 2017. 

58. Based on my training and experience, electronic communications using encrypted 
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 
device used to send and receive those communications. Communications from those applications 
can be obtained by law enforcement by searching the device either manually or via a data 
extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 

15 This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 
about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State. 
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including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wickr, 
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review 
of the device and the downloaded application can reveal other evidence of encrypted 
communications, such as call logs and contact lists. 

59. The FBI continues to seek evidence of Stone’s communications and contacts during 
the period of the 2016 U.S. presidential election and through the present. The FBI believes these 
communications may contain evidence of additional communications concerning Assange, 
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such 
communications could constitute additional evidence of Stone’s efforts to obstruct HPSCI’s 
investigation by showing additional contacts and communications about Assange and WikiLeaks 
that Stone failed to disclose. 

I. The Subject Devices 

60. In or around November 2018, media reports began to publish excerpts of text 
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from Stone 

According to these news articles, Stone released these messages to the media outlets, which Stone 
claimed were extracted by his lawyers from “a cell phone he stopped using in 2016.” Based on 
these statements and described further below, your affiant believes the cell phone referenced in the 
article to be the iPhone 5s. 17 


16 See, e.g., “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 
Backchannel,” Daily Caller, Nov. 14,2018, available at https://dailycaller.com/2018/11/14/roger- 
stone-wikileaks-randy-credico-mueller. 

1 . Ni’i-c Pi-.'UULvd k-\; bvTxwcn < ;vdiu' atv 

mmHn^atesMmtim^exUnessag^roduced by Stone occurred on or about November 14, 2016. 
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61. On or about February 11, 2019, investigators, with the consent of Roger Stone’s 

attorneys, spoke with^^^^^^^J a certified forensic examiner who stated he had been retained 
by Roger Stone’s attorneys. had been authorized by Stone’s attorneys to provide the 

Subject Devices to the FBI, although in providing the devices, Stone did not consent to their search. 
Stillman gave the Agents three devices: the iPhone 5s, the iPhone 7, and the external hard drive. 

62. produced documentation to investigators indicating that the iPhone 5s was 

associated with the phone number ending in Stone’s cellular number as discussed above. 

The documentation also indicated that^^^^J had imaged the iPhone 5s on or about November 
10, 2018, several days before the article discussed above where Stone claimed to have released 
newly-uncovered messages with Credico. Toll records produced by AT&T pursuant to subpoena 
indicate that Stone used an iPhone 5s from at least on or about January 1, 2015 through on or about 
November 14, 2016. Therefore, it appears that the iPhone 5s was the device Stone was using 
through November 14, 2016 to communicate with individuals including Credico and Corsi. 

63. also produced documentation to investigators that the iPhone 7 he 

provided to investigators was associated with the same Stone phone number ending in As 

discussed above, toll records produced by AT&T pursuant to subpoena indicate that Stone used an 
iPhone 7 from at least on or about November 14,2016 through on or about February 25, 2018. As 
described above, Stone communicated extensively with Credico during this time. Toll records 
also indicate Stone continued to communicate with Corsi during this time period using the x3034 
number. 


The government believes copies of later-in-time text messages from late 2016 and early 2017 could 
be located on another device, such as the iPhone 7, or on backup storage media. 
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64. ^^^^^Wurther told investigators that the external hard drive contained forensic 
images of Stone’s computers. ^^J^^tated that the hard drive contained backups created by a 
separate company in September 2017 from Stone’s computers in both Florida and New York. 
According to^^^^Jthe backups were created as “clone copies,” which are copies of Stone’s 
computer systems. ^^^^|also indicated that the drive contained a separate image 
created in March 2018 of Stone’s computer in Florida, as well as backup images of the iPhones 
discussed above. As explained further herein, there is reason to believe that these images contain 
communications made by Stone with Credico, Corsi, and others made during the relevant time 
period, even if such communications had previously been deleted. 

COMPUTERS. ELECTRONIC STORAGE. AND FORENSIC ANALYSIS 

65. As described herein and in Attachment B, this application seeks permission to 
search the Subject Devices. One form in which the records might be found is data stored on a 
device’s hard drive. Thus, the warrants applied for would authorize the search of electronic storage 
media. 

66. Probable cause. I submit that there is probable cause to believe those records will 
be stored on the Subject Devices (the term “computer” below refers to Subject Devices), for at 
least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic 
files downloaded to a storage medium can be stored for years at little or no cost. 
Even when files have been deleted, they can be recovered months or years later 
using forensic tools. This is so because when a person “deletes” a file on a 
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computer, the data contained in the file does not actually disappear; rather, that data 
remains on the storage medium until it is overwritten by new data. 

b. Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space—that is, in space on the storage medium that is not currently being used 
by an active file—for long periods of time before they are overwritten. In addition, 
a computer’s operating system may also keep a record of deleted data in a “swap” 
or “recovery” file. 

c. Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file system 
data structures, and virtual memory “swap” or paging files. Computer users 
typically do not erase or delete this evidence, because special software is typically 
required for that task. However, it is technically possible to delete this information. 

d. Similarly, files that have been viewed via the Internet are sometimes automatically 
downloaded into a temporary Internet directory or “cache.” 

67. Forensic evidence. As further described in Attachment B, this application seeks 
permission to locate not only computer files that might serve as direct evidence of the crimes 
described on the warrant, but also for forensic electronic evidence that establishes how computers 
were used, the purpose of their use, who used them, and when. There is probable cause to believe 
that this forensic electronic evidence will be on the Subject Devices because: 
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a. Data on the storage medium can provide evidence of a ftle that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). Virtual 
memory paging systems can leave traces of information on the storage medium that 
show what tasks and processes were recently active. Web browsers, e-mail 
programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB flash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were 
created, although this information can later be falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, where, 
and how” of the criminal conduct under investigation, thus enabling the United 
States to establish and prove each element or alternatively, to exclude the innocent 
from further suspicion. In my training and experience, information stored within a 
computer or storage media (e.g., registry information, communications, images and 
movies, transactional information, records of session times and durations, internet 
history, and anti-virus, spyware, and malware detection programs) can indicate who 
has used or controlled the computer or storage media. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. The existence or absence of anti-virus, spyware, and 
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malware detection programs may indicate whether the computer was remotely 
accessed, thus inculpating or exculpating the computer owner. Further, computer 
and storage media activity can indicate how and when the computer or storage 
media was accessed or used. For example, as described herein, computers typically 
contains information that log: computer user account session times and durations, 
computer activity associated with user accounts, electronic storage media that 
connected with the computer, and the IP addresses through which the computer 
accessed networks and the internet. Such information allows investigators to 
understand the chronological context of computer or electronic storage media 
access, use, and events relating to the crime under investigation. Additionally, 
some information stored within a computer or electronic storage media may provide 
crucial evidence relating to the physical location of other evidence and the suspect. 
For example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data typically 
also contains information indicating when the file or image was created. The 
existence of such image files, along with external device connection logs, may also 
indicate the presence of additional electronic storage media (e.g., a thumb drive). 
The geographic and timeline information described herein may either inculpate or 
exculpate the computer user. Last, information stored within a computer may 
provide relevant insight into the computer user’s state of mind as it relates to the 
offense under investigation. For example, information within the computer may 
indicate the owner’s motive and intent to commit a crime (e.g., internet searches 
indicating criminal planning), or consciousness of guilt (e.g., running a “wiping” 
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program to destroy evidence on the computer or password protecting/encrypting 
such evidence in an effort to conceal it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about how 
computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in advance 
the records to be sought, computer evidence is not always data that can be merely 
reviewed by a review team and passed along to investigators. Whether data stored 
on a computer is evidence may depend on other information stored on the computer 
and the application of knowledge about how a computer behaves. Therefore, 
contextual information necessary to understand other evidence also falls within the 
scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular thing 
is not present on a storage medium. For example, the presence or absence of 
counter-forensic programs or anti-virus programs (and associated data) may be 
relevant to establishing the user’s intent. 
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FILTER REVIEW PROCEDURES 

Review of the items described in Attachment B will be conducted pursuant to established 
procedures designed to collect evidence in a manner consistent with professional responsibility 
requirements concerning the maintenance of attorney-client and other operative privileges. The 
procedures include use of a designated “filter team,’’ separate and apart from the investigative 
team, in order to address potential privileges. 

CONCLUSION 

68. Based on the foregoing, your affiant respectfully requests that this Court issue a 
search warrant for the Subject Devices, more particularly described in Attachment A authorizing 
the seizure of the items described in Attachment B. 


Respectfully submitted. 





K. Heide 
Special Agent 

Federal Bureau of Investigation 


Sworn and subscribed before me on 


/ 

this / ✓ day of February, 2019. 



The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to be Searched 


The following devices provided to the FBI byl 


I. currently in the District of 


Columbia: 
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ATTACHMENT B 

Items to be seized from the Subject Devices 

1. The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 

a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 

b. Documents reflecting communications between Stone and Jerome Corsi; 

c. Documents reflecting communications between Stone and Randy Credico; 

d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, 

Paul Manafort, Richard Gates, and Donald J. Trump; 

e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 
the Federal Bureau of Investigation; 

f. Records and information relating to the e-mail accounts 
and 

g. Records and information relating to the WhatsApp account associated with 
telephone number 
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h. Records and information relating to the Signal account associated with telephone 
numbe 

i. Records and information relating to the Wickr account associated with telephone 
numbe 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and ownership 
of the computer systems, such as telephone records, notes, notebooks, diaries, and 
reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For all of the devices listed in Attachment A (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the things 
described in this warrant were created, edited, or deleted, such as logs, registry 
entries, configuration files, saved usernames and passwords, documents, browsing 
history, user profiles, email, email contacts, “chat,” instant messaging logs, 
photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to determine 
the chronological context of computer access, use, and events relating to crime 
under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime under 
investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 
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AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant 


United States District Court 

for the 

Southern District of New York 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case No. 

) 

) 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Southern District of _ New York _ 

(identify the person or describe the property to be searched and give its location)\ 

See Attachment A 

The person or property to be searched, described above, is believed to conceal (identify the person or describe the property 
to be seized)'. 

See Attachment A 




The search and seizure are related to violation(s) of (insert statutory citations): 

18 U.S.C. §§ 1001, 1505, 1512(b)(1) 

I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or 
property. 

YOU ARE COMMANDED to execute this warrant on or before 


February 6, 2019 


(not to exceed 14 days) 

S?f in the daytime 6:00 a.m. to 10 p.m. □ at any time in the day or night as I find reasonable cause has been 

established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the 1 copy and receipt at the 
place where the property was taken. in < ' n \ t ' l h } u t 

The officer executing this warrant, or an officer present during the execution of tlae warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory tothcClbrk of the Court. f 

/upon its return, this warrant and inventory should be filed under seal by the;Clerk of the Cquxh 

‘ ! N . USMJ Initials 

■ >. . ■ / . 1 > 

□ I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except.-for .delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) Clfor days (not to exceed 30). * ’ 1 ’ 

• 'i ,; i ',!■ 1 ' 

□until, the facts justifying, the later specific, date of . ___. 

Date and time issued: / [ 9 / 04} O■v’7- _ ^ 

City and state: New York, NY _ 



Judge *s signature 

Hon. Robert W. Lehrburger 


Printed name and title 
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AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and tune warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant 
to the Court. 


Date: _ _ 

Executing officer } s signature 


Printed name and title 
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ATTACHMENT A 

I. Premises to be Searched - Subject Premises 


The premises to be searched (the “Subject Premises”) are described as follows, and 
include all locked and closed containers found therein: 



II. Items to Be Seized 


A. Evidence, Fruits, and Instrumentalities of the Subject Offenses 

The items to be seized from the Subject Premises include the following evidence, fruits, 
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction 
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code, 
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(1) (witness 
tampering); (collectively the “Subject Offenses”), for the period June 2015 to the present, 
described as follows: 

a. Evidence concerning who occupies or owns the Subject Premises, including 
without limitation, utility and telephone bills, mail envelopes, addressed 
correspondence, diaries, statements, identification documents, address books, 
telephone directories, and keys; 

b. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
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c. Documents that reflect communications between Roger Stone and Jerome Corsi 
that concern the Subject Offenses; 

d. Documents reflecting communications between Roger Stone and Randy Credico 
that concern the Subject Offenses; 

e. Documents reflecting communications between Roger Stone and members of the 
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon, 

Paul Manafort, Richard Gates, and Donald J. Trump, that concern the 
Subject Offenses; 

f. Documents related to or discussing investigations into Russian interference in the 
2016 U.S. presidential election and related matters by the U.S. House of 
Representatives Permanent Select Committee on Intelligence; the U.S. Senate 
Select Committee on Intelligence; and/or the Federal Bureau of Investigation; 

g. Records and information relating to the use, ownership, or control of e-mail 

h. Records and information demonstrating who uses, owns, or controls the WhatsApp 
account associated with telephone numbei^^^^^^^J; 

i. Records and information demonstrating who uses, owns, or controls the Signal 
account associated with telephone number^^^^^^J; 

j. Records and information demonstrating who uses, owns, or controls the Wickr 
account associated with telephone numbei^^^^^^^^ 

k. Records pertaining to accounts held with Internet Service Providers providing 
service at or to the Subject Premises; 
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l. Computers and media storage devices, including tablets/iPads, and records or 
documents demonstrating who operates, owns, or controls such devices, such as 
telephone records, notes, notebooks, diaries, and reference materials, in whatever 
form; and 

m. Cellular telephones, smartphones, or personal data assistant devices, and records or 
documents demonstrating who operates, owns, or controls such devices, such as 
telephone records, notes, notebooks, diaries, and reference materials, in whatever 
form. 

B. Search and Seizure of Electronically Stored Information 

The items to be seized from the Subject Premises also include any computer devices and 
storage media that may contain any electronically stored information falling within the categories 
set forth in Section II.A.a-k of this Attachment above, including, but not limited to, desktop and 
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones, 
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this 
warrant also authorizes the copying of such devices or media for later review. 

The items to be seized from the Subject Premises also include: 

1. Any ite ms or records needed to access the data stored on any seized or copied 
computer devices or storage media, including but not limited to any physical keys, encryption 
devices, or records of login credentials, passwords, private encryption keys, or similar information. 

2. Any ite ms or records that may facilitate a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media. 

3. Any evidence concerning the identities or locations of those persons with access to, 
control over, or ownership of the seized or copied computer devices or storage media. 

C. Review of ESI 

Following seizure of any computer devices and storage media and/or the creation of 
forensic image copies, law enforcement personnel (who may include, in addition to law 
enforcement officers and agents, attorneys for the government, attorney support staff, agency 
personnel assisting the government in this investigation, and outside technical experts under 
government control) are authorized to review the ESI contained therein for information 
responsive to the warrant. 
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In conducting this review, law enforcement personnel may use various techniques to 
locate information responsive to the warrant, including, for example: 

• surveying various file “directories” and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); 

• opening or cursorily reading the first few “pages” of such files in order to determine 
their precise contents; 

• scanning storage areas to discover and possibly recover recently deleted files or 
deliberately hidden files; 

• performing key word searches through all electronic storage areas to determine whether 
occurrences of language contained in such storage areas exist that are intimately related 
to the subject matter of the investigation; and 

• reviewing metadata, system information, configuration files, registry data, and any 
other information reflecting how, when, and by whom the computer was used. 

Law enforcement personnel will make reasonable efforts to search only for files, 
documents, or other electronically stored information within the categories identified in Sections 
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to 
conduct a complete review of all the ESI from seized devices or storage media if necessary to 
evaluate its contents and to locate all data responsive to the warrant. 
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AO 106 (SDNY Rev. 01/17) Application for a Search Warrant 


United States District Court 

for the 

Southern District of New York 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

See Attachment A 



) 

) 

) 



\ 

& 


APPLICATION FOR A SEARCH AND SEIZURE WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): _ . _ 

the Known as ||[||||||||||||0||||||||0||||||||||||||||||||^^ 

located in the _ Southern District of_ New York _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attached Affidavit and its Attachment A 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
0^evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

^property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section(s) Offense Description(s) 

18 U.S.C. §§ 1001, 1505, False statements, witness tampering, obstruction of proceedings 
1512(b)(1) before departments, agencies, and committees 

The application is based on these facts: 

See Attached Affidavit and its Attachment A 


l?f Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: _______ ) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Sworn to before me and signed in my presence. 



City and state: New York, NY 



> SA Mickey J, Robinson 

, Primed name and title 



' / Judge *s signature V p 

Hon. Robert W. hehfburger 


Prthie’d itCnne mid title 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE SOUTHERN DISTRICT OF NEW YORK 


In the Matter of the Application of the United 
States Of America for a Search and Seizure 
Warrant for the Premises Known and Described 



TO BE FILED UNDER SEAL 

Agent Affidavit in Support of 
Application for Search and Seizure 

Warrant 


SOUTHERN DISTRICT OF NEW YORK: 


Mickey J. Robinson, being duly sworn, deposes says: 

I. Introduction 

A. Affiant 

1. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been since September 2012. I successfully completed New Agent Training at Quantico, Virginia, 
where I received extensive instruction on criminal investigations. 

2. I make this affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to search the premises specified below (the “Subject 
Premises”) for, and to seize, the items and information described in Attachment A. This affidavit 
is based upon my personal knowledge; my review of documents and other evidence; my 
conversations with other law enforcement personnel; and my training, experience and advice 
received concerning the use of computers in criminal activity and the forensic analysis of 
electronically stored information (“ESI”). Because this affidavit is being submitted for the limited 
purpose of establishing probable cause, it does not include all the facts that I have learned during 
the course of my investigation. Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported in substance and in part, except where 
otherwise indicated. 
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C. The Subject Offenses 


4. For the reasons detailed below, I believe that there is probable cause to believe that 
the Subject Premises contain evidence, fruits, and instrumentalities of violations of (i) Title 18, 
United States Code, Section 1505 (obstruction of proceedings before departments, agencies, and 
committees); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code, Section 1512(b)(1) (witness tampering); (collectively the “Subject Offenses”). 

II. Probable Cause 

A. Probable Cause Regarding Commission of the Subject Offenses 

5. I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, and 
information provided to me by other law enforcement officers and technical experts. 

6. This affidavit is intended to show merely that there is sufficient probable cause for 
the requested warrant and does not set forth all of my knowledge about this matter. Unless 
specifically indicated, all conversations and statements in this affidavit are related in substance 
and part. Where I assert that an event took place on a particular date, I am asserting that it took 
place on or about the date specified. 
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7, For the reasons set forth in this Affidavit, there is probable cause to believe that one 
or more of the Subject Offenses have been committed by Roger Jason Stone, Jr., (“Roger Stone”) 
and others known and unknown to the government. Further, there is probable cause to believe the 
Subject Premises have been used to facilitate the commission of one or more of the Subject 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Subject Offenses may be present in the Subject Premises. 

Background on Relevant Individuals 

8. Based on publicly available information and information obtained in the 
investigation, I know the following: 

a. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential 
campaign of Donald J. Trump (“Trump Campaign”) until in or around August 
2015, and subsequently maintained regular contact with and publicly supported the 
Trump Campaign through the 2016 election. 

b. Julian Assange is the founder and director of WikiLeaks, which is publicly 
described as a non-profit organization that disseminates non-public information and 
classified media provided by anonymized sources. WikiLeaks has posted numerous 
documents stolen from the U.S. government. At all relevant times, Assange was 
located at the Ecuadorian Embassy in London, United Kingdom. 

c. Jerome Corsi is a political commentator who worked with an online media 
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi 
spoke regularly with Stone throughout the campaign, including about the release of 
stolen documents by WikiLeaks. 
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e. Randy Credico was a radio host who has known Stone for more than a decade. In 
testimony before U.S. House of Representatives Permanent Select Committee on 
Intelligence (“HPSCI”) on or about September 26, 2017, Stone described Credico 
(without naming him) as an “intermediary,” “go-between,” and “mutual friend” to 
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified 
Credico by name and claimed Credico was the “gentleman who confirmed for Mr. 
Stone” that Assange, had “‘[e] mails related to Hillary Clinton which are pending 
publication.’” 

f. Richard Gates is a U.S. citizen who served for years as a political consultant and 
lobbyist along with Paul Manafort. From in or around June 2016 until November 
2016, Gates served as the deputy campaign chairman of the Trump Campaign. On 
February 23, 2018, Gates pled guilty to one count of conspiracy against the United 
States and one count of making false statements to federal law enforcement officers. 
United States v. Gates, l:17-cr-201 (D.D.C.). 

g. Stephen K. Bannon is a U.S. citizen who serves as a political consultant. Beginning 
in or around August 2016 and through the 2016 U.S. presidential election, Bannon 
served as the chief executive officer of the Trump Campaign. 
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Hacking Activity During the 2016 Presidential Election 


9. John Podesta is a U.S. citizen who served for years as a political consultant. During 
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary 
Clinton presidential campaign (“Clinton Campaign”). On or about March 24, 2016, Podesta 
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the 
email was recovered by the FBI from a subsequent release of stolen emails, described below). 
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving 
the email, his assistant (who also had access to the account) clicked on a link within the email and 
entered the account password when prompted (believing this prompt to be part of a security 
protocol). Based on my training and experience, this activity appears to have been a successful 
spearphishing operation through which an actor would have gained access to Podesta’s email 
account allowing the actor to steal emails and documents from that account. 

10. The Democratic National Committee (“DNC”) and Democratic Congressional 
Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal elections. 
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016 
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special 
Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became aware that their 
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity 
company CrowdStrike to investigate the intrusions and remediate. 

1 In my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 
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11. On or about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred to 
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “[b]oth adversaries 
engage in extensive political and economic espionage for the benefit of the government of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

12. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 
conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, l:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the 
Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s military 
intelligence agency. 

WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 

13. As alleged in the Netyksho indictment, after successfully hacking the DNC and 
DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the stolen 
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the 
transfers using online personas created by the GRU, including “Guccifer 2.0” and “DCLealcs.” 
(GRU officers separately used these personas to release some of the stolen documents). 

14. On or about July 22, 2016, WikiLeaks released tens of thousands of documents 
stolen from the DNC network. These stolen documents included communications by senior DNC 


6 





Case l:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 14 of 56 


officials about campaign strategy, financial and fundraising data, and other documents related to 
the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

15. Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 
documents that had been stolen from John Podesta, releasing a total of over 50,000 stolen 
documents. 

Stone’s Communications About WikiLeaks During the Campaign 

16. In April 2018 interviews with the Special Counsel’s Office, Gates stated that 
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone 
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate 
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by 
WikiLeaks, Gates observed a conversation between Manafort and Stone, in which they discussed 
WikiLeaks and Stone’s prediction of the release. 

17. According to Gates, Manafort directed Gates to contact Stone about any additional 
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates 
contacted Stone, who made statements claiming that there would be potential future releases of 
damaging material by WikiLeaks. In a separate interview with the Special Counsel’s Office in or 
around October 2018, Gates recalled that at one point during the campaign he was with then- 
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing 
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming. 
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18. Emails recovered through a court-authorized search of Stone’s email account 
show that shortly after the July 22, 2016 release of stolen DNC emails 
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 

a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 

line, “Get to Assange.” The body of the message read, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails .. . they 
deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 
Stone’s email to who lived in the United Kingdom and was a supporter of 

the Trump Campaign. 

b. On or about July 31, 2016, Stone emailed Corsi with the subject line, “Call me 
MON.” The body of the email read in part that^^^^ “should see Assange.” 

c. On or about August 2,2016, Corsi emailed Stone and wrote that he was currently 
in Europe and planned to return in mid-August. Corsi stated, “Word is friend in 
embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. Impact 
planned to be very damaging.” In a law enforcement interview, Corsi stated that 
the phrase “friend in embassy” referred to Assange. Corsi added in the same email, 
“Time to let more than Podesta to be exposed as in bed w enemy if they are not 



2 A search was authorized on or about September 11,2017 by the U.S. 

District Cou^fflnnflHffl^ffl^^mmbia. Case No. l.T7-mj-661 (D.D.C. Sept 11, 2017). A 
second search was authorized on or about August 3,2018 by the U.S. 

District Court Case No. l:18-sc-2582 (D.D.C. Aug. 3,2018). On or 

about September 26,2018, the government obtained and executed an order pursuant to 18 U.S.C. 
§ 2703(d) for records connected to^^H^^^H^H^^^ICase No. 1:18-sc-2911 (D.D.C. Sept. 
26, 2018). Records provided in respons^^vucrosof^orporation confirmed that the account 
was still active and that the relevant emails described in this affidavit were not deleted from the 
account. 
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ready to drop HRC. That appears to be the game hackers are now about. Would 
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she 
well. I expect that much of next dump focus, setting stage for Foundation debacle.” 

19. According to recorded public statements recovered by the FBI, starting in early 
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 
statements about information he claimed to have learned from Assange: 

a. According to a public video posted to YouTube, on or about August 8,2016, Stone 
attended a public event in Broward County, Florida. Dining the event, Stone stated, 
“I actually have communicated with Assange. I believe the next tranche of his 
documents pertain to the Clinton Foundation, but there’s no telling what the 
October surprise may be.” 

b. According to a public video posted to YouTube, on or about August 12,2016, Stone 
was interviewed for a video segment on the show InfoWars, hosted by Alex Jones. 
During the interview, Stone stated that he was “in communication with Assange” 
but was “not at liberty to discuss what I have.” 

c. According to a public video posted to YouTube, on or about August 16,2016, Stone 

- stated during another inteiview with Alex Jones that “it became known on this 

program that I have had some back-channel communication with WikiLeaks and 
Assange.” In a second interview on or about the same day with Dana Loesch of 
the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and that 
they had a “mutual acquaintance who is a fine gentleman.” 

d. According to a video posted to the public website of the TV station C-SPAN, during 
a C-SPAN television interview on or about August 18, 2016, Stone stated that he 
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had communicated with Assange through an “intermediary, somebody who is a 
mutual friend.” 

e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 
interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
the interview, Credico asked Stone, “ You’ve been in touch indirectly with Assange. 
Can you give us any kind of insight? Is there an October surprise happening?” 
Stone responded, “Well, first of all, I don’t want to intimate in any way that I control 
or have influence with Assange because I do not. ... We have a mutual friend, 
somebody we both trust and therefore I am a recipient of pretty good information.” 
In or November Stone 

produced a series of text messages between Stone and Credico during the 2016 presidential 
campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone 
exchanged written communications with Credico about what WikiLeaks and Assange planned to 
do. Emails recovered through a court-authorized search of Stone’s email account 

show additional written communications between Stone and Credico 
about WikiLeaks in or around September 2016. 

a. On or about August 19,2016, Credico sent a text message to Stone that read in part, 
“I’m going to have Mian Assange on my show next Thursday.” On or about 
August 21, 2016, Credico sent another text message to Stone, writing in part, “I 
have Mian Assange on Thursday so I’m completely tied up on that day.” 

3 As discussed below, Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 


10 





Case l:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 18 of 56 


b. On or about August 25, 2016, Assange was a guest on Credico’s radio show for the 
first time. On or about August 26,2016, Credico sent a text message to Stone that 
stated, “Julian Assange talk[ed] about you last night.” Stone replied and asked what 
Assange said, to which Credico responded, “He didn’t say anything bad we were 
talking about how the Press is trying to make it look like you and he are in cahoots.” 

c. On or about August 27, 2016, Credico sent text messages to Stone that said, “We 
are working on a Julian Assange radio show,” and that he (Credico) was “in charge” 
of the proj ect. In a text message sent later that day, Credico added, “Julian Assange 
has kryptonite on Hillary.” 

d. On or about September 18,2016, Stone sent a text message to Credico that said, “I 
am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 
added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

e. Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 
State. Stone stated, “Please ask Assange for any State or HRC e-mail from August 
10 to August 30 — particularly on August 20,2011 that mention [the subject of the 
article] or confirm this narrative.” 

f. On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message ... to Assange.” Credico responded, “I did.” On or about September 20, 
2016, Credico forwarded the request to a close friend who was an attorney with the 
ability to contact the Assange. Credico blind-copied Stone on the forwarded email. 


11 


Case l:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 19 of 56 


g. On or about September 30,2016, Credico sent Stone via text message a photograph 
of Credico standing outside the Ecuadorian Embassy in London where Assange 
was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday ... now pretend u don’t know me ... 
Hillary’s campaign will die this week.” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4,2016, which was reported to be the 10-year anniversary 
of the founding of WikiLeaks. 

i. On or about October 2,2016, Stone emailed Credico, with the subject line “ WTF?” 
and a link to an article at the website http://heatst.com/politics/october-surprise- 
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to- 
security-concems. Credico responded to Stone, “head fake.” 

j. On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off.” Credico initially responded, “I can’t tal[k] about it.” After 
further exchanges with Stone, Credico responded, “I think it[’]s on for tomorrow.” 
Credico added, “Off the Record Hillary and her people are doing a full-court press 
they [sic] keep Assange from making the next dump ... That’s all I can tell you on 
this line ... Please leave my name out of it.” 

21. Emails and text messages recovered by the FBI show that, in or around October 
2016, Stone made statements about Assange’s future releases, including statements that were 
similar to statement that Credico made to him. For example: 
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a. 


b. 


c. 


d. 


In a court-authorized search of Stone’s email accoun^^^^^^^^^^^^^ the 
FBI recovered an email from Stone sent on or about October 3, 2016, 

which stated in part, “Spoke to my friend in London last night. The payload is still 
coming.” 

In a court-authorized search the FBI also recovered an 

email exchange from on or about October 3, 2016 between Stone and a reporter 
who had connections to Steve Bannon. In the exchange, the reporter asked, 
“Assange - what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell 
Bannon but he doesn’t call me back.” 

On or about October 4, 2016, Assange held a press conference but did not release 
any new materials pertaining to the Clinton Campaign. In a court-authorized search 
of^^^^^^^^^^^^Jthe FBI recovered an email exchange between Stone and 
Bannon on or about October 4, 2016 that occurred after the press conference. In 
the exchange, Bannon asked, “What was that this morning???,” referring to 
Assange’s press conference. Stone responded, “Fear. Serious security concern. He 
thinks they are going to kill him and the London police are standing do[wn]. 
However - a load every week going forward.” 

In a court-authorized search of Stone’s iCloud account, 4 5 the FBI recovered text 
messages between Stone and^^^from on or about October 4,2016. In one text 


4 A search of was authorized on or about October 17, 2017 by the U.S. 

District Court^Wn^^ml^^^^OTumbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A 
second search of was authorized on or about August 3, 2018 by the U.S. 

District Court for Case No. l:18-sc-2583 (D.D.C. Aug. 3, 2018). 

5 A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. l:18-sc-662 (D.D.C. Mar. 14, 2018). The 
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message, asked Stone if he had “hear[d] anymore from London.” Stone 

replied, “Yes - want to talk on a secure line - got Whatsapp.” In an interview with 
the Special Counsel’s Office in or around May 2018, ^^^Jconfirmed that he and 
Stone spoke and that Stone had told him WikiLeaks had more material to release, 
and that the material was related to senior people associated with Clinton. 

22. On or about October 7,2016, WikiLeaks released the first set of emails stolen from 
Podesta. According to text messages recovered from Stone’s iCloud account, shortly after the 
release, an associate of Bannon sent a text message to Stone that read, “well done.” Similarly, 
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, 
Stone said, “I told you this was coming.” 

Stone’s Communications with the House Permanent Select Committee on Intelligence 

23. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 
allegations of Russian interference in the 2016 presidential election and possible links to 
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about 
March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 
were of interest to the committee. 


records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 

6 On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (“SSCI”) announced the committee would conduct an inquiry that would 
investigate, among other things, any intelligence regarding links between Russia and individuals 
associated with political campaigns, as well as Russian cyber activity and other “active 
measures” directed against the United States in connection with the 2016 election. 
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24. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily appear 
before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was 
recovered by the FBI from a court-authorized search of Stone’s email account 

The letter requested Stone produce: 

Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's publicly- 
announced parameters. 

25. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and 
stated that “Mr. Stone has no documents, records, or electronically stored information, regardless 
of form, other than those widely available that reasonably could lead to the discovery of any facts 
within the investigation’s publicly-announced parameters.” (A copy of the letter was recovered 
from a court-authorized search of Stone’s email accoun^^^^^^^^^^^^). 

Stone’s Testimony Before HPSCI 

26. On or about September 26, 2017, Stone provided HPSCI with an “opening 
statement” that his counsel requested be included as part of the record of proceedings before 
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, 7 Stone 
stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 


7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence horn Stone’s counsel to members of HPSCI. 
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responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” 

27. Also on or about September 26,2017, Stone provided testimony in a closed session 
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was transcribed, and a 
copy of the transcript was obtained by the Department of Justice from HPSCI in or around 
December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he 
would tell the truth. At the beginning of the hearing, Stone was admonished that “it is unlawful to 
deliberately provide false information to Members of Congress or staff’ and that “providing false 
information to this committee or concealing material information from this committee is a cri m e 
punishable by law.” 

Stone T Testimony. About Documents^ He Possessed Relatecj to WikiLeaks 

28. During his HPSCI testimony. Stone was asked about HPSCI’s May 2017 document 
request and whether Stone had any documents or written communications that discussed Julian 
Assange, Russian interference, or other relevant documents: 

Q: The committee wrote to you on May 9th requesting no later 

than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation. 

You wrote back through counsel that you had no documents, 
records, or electronically stored information regardless of 
form responsive to our requests. Was that a false statement? 

A: That is not a false statement. That’s what--1 believe that to 

be true. 

[...] 

Q: So you have no emails to anyone concerning the allegations 

of hacked documents or your conversations with the 
Guccifer 2[.0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 


16 




Case l:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 24 of 56 


A: That is correct. Not to my knowledge. I think we met, again, 

the precise criteria of your request, and we complied. Again, 
if you have a more specific request, I'm happy to go back and 
look.... 

Q: I just want to ask you under oath - 

A: We did an extensive search consistent with the direction of 

my attorneys, and we found nothing that met the criteria that 
you asked for. 

Q: I just want to be certain because you are under oath, where 

your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange or 
Guccifer 2[.0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've written 
no documents yourself. 

A: In connection with Russian collusion, consistent with your 

exact and precise request, yes. 

29. In fact, and as described above, Stone had sent and received numerous emails and 
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 
WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 

(including^^^^^^^^^^^^^^^^^^^^^^^^^^^) and show 

at the time of his testimony, Stone was still in possession of many of these emails and text messages 
at the time he testified on or about September 22,2017. 8 These written communications included 
(a) Stone’s email to Corsi on or about July 25, 2016, that read in part, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they deal with 


8 The warrant for Stone’s email accountwas obtained on or about 
September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account 
was active and the emails in question were not deleted from the account. The warrant for Stone’s 
email account obtained on or about October 17, 2017 and executed 

shortly thereafml^^rt^^imiS^nSone’s iCloud account (which contained the text messages 
described above) was obtained on or about March 14, 2018 and executed shortly thereafter. 
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Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31,2016 that^^^J “should 
see Assange”; (c) Corsi’s email to Stone on or about August 2,2016 that stated in part, “Word is 
friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. Impact planned 
to be very damaging.”; (d) dozens of text messages and emails between Stone and Credico, 
beginning on or about August 19, 2016 and continuing through duration of the election, in which 
they discussed WikiLeaks and Assange; (e) Stone’s email to on or about October 3, 2016 

that read in part “Spoke to my friend in London last night. The payload is still coming.”; and (f) 
Stone’s email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release “a 
load every week going forward.” 

Stone’s Testimony About His Early, August 2016_ Statements 

30. During his HPSCI testimony on or about September 26, 2017, Stone was asked to 
explain his statements in early August 2016 about being in contact with Assange. Stone was 
specifically asked about his statement on or about August 8, 2016 that “I’ve actually 
communicated with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

31. Stone testified that these public references to having a means of contacting 
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 
between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 
name of this “intermediary,” but he provided a description in his testimony that was largely 
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr. Stone” that 
Assange had ‘“[ejmails related to Hillary Clinton which are pending publication.’”). 

32. In fact, documents recovered during the investigation 
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show that Stone did not begin communicating 
with Credico about Assange or WikiLeaks until on or about August 19, 2016 9 —approximately 
eleven days after Stone first claimed on or about August 8,2016 to “actually have communicated 
with Assange” and a week after to his August 12, 2016 statements of being “in communication 
with Assange” and “not at liberty to discuss what I have ” 

33. When interviewed by the FBI, Credico stated that the first time he ever spoke with 
Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico also 
provided the FBI with partially redacted emails that he claimed were between he and another 
member of WikiLeaks from on or about August 25, 2016, in which the two discuss the technical 
logistics for the interview later that day. During the exchange, Credico offered biographical 
information about himself, apparently as a means of introduction. 

34. The FBI has not identified any communications between Stone and Credico from 
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed 
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks. 

35. In contrast, and as described above, the FBI has identified written communications 
prior to August 8,2016 in which Stone directed Corsi—not Credico—to contact Assange. On or 
about July 25,2016, for example, Stone wrote to Corsi, “Get to Assange [a]t Ecuadorian Embassy 
in London and get the pending WikiLeaks emails . . . they deal with Foundation, allegedly.” 
Similarly, on or about August 2,2016, Corsi—not Credico—sent an email to Stone in which Corsi 

9 As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25,2016, Credico 
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted 
Stone that “Assange has kryptonite on Hillary.” 


10 Credico was first interviewed by the FBI in or around August 2018. He has subsequently 
participated in multiple voluntary interviews. 
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wrote that “[w]ord is friend in embassy plans 2 more dumps,” including one in October. These 
communications occurred days before Stone’s first public statement on or about August 8, 2016 
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to 
HPSCI as another individual Stone contacted to serve as a “go-between,” “intermediary,” or other 
source for information from WikiLeaks. Stone also.never disclosed his written communications 
with Corsi to HPSCI when answering HPSCI’s questioning about the August 8,2016 and August 
12, 2016 statements about being in communication with Assange. 

Stone’s Testimony. About Cormmncqtions to Assange 

36. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 
communicate anything else to Assange?” Stone responded, “I did not.” Stone was then asked, 
“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 
not.” 

37. In fact, starting on or about September 18,2016, Stone directed Credico to pass on 
a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 

a. According to text messages on or about 

September 18,2016, Stone sent a text message to Credico that said, “I am e-mailing 
u a request to pass on to Assange.” On or about the same day, Stone emailed 
Credico an article with allegations against then-candidate Clinton related to her 
service as Secretary of State. Stone added, “Please ask Assange for any State or 
HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that 
mention [the subject of the article] or confirm this narrative.” (A copy of this email 
was obtained through a search of Stone’s email account 
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b. According to text messages on or about 

September 19, 2016, Stone texted Credico again, writing “Pass my message ... to 
Assange.” Credico responded, “I did.” An email obtained from the account 

shows that on or about September 20, 2016, Credico 
forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 

Stone’s Testimony About Written Communications with Credico 
38. During his HPSCI testimony, Stone was asked repeatedly about his 
communications with the person he identified as his intermediary. Stone stated that he had never 
communicated with his intermediary in writing in any way. During one exchange, Stone claimed 
only to have spoken with the intermediary telephonically: 

Q: [H]ow did you communicate the intermediary? 

A: Over the phone. 

Q: And did you have any other means of communicating with 

the intermediary? 

A: No. 

Q: No text messages, no - none of the list, right? 

A: No. 

Later during his testimony, Stone again denied ever communicating with his intermediary in 
writing: 

Q: So you never communicated with your intermediary in 

wilting in any way? 

A: No. 

Q: Never emailed him or texted him? 

A: He’ s not an email guy. 
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Q: So all your conversations with him were in person or over 

the phone. 

A: Correct. 

39. As described above, Stone and Credico (who Stone identified as his intermediary) 
engaged in frequent written communication by email and text message. Beginning on or about 
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico 
engaged in dozens of communications by email or text message in which they discussed 
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton 
Campaign. 

40. Written communications between Stone and Credico continued up until Stone’s 
HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 
Stone testified before HPSCI and denied having ever sent or received emails or text messages from 
his identified intermediary, Stone and Credico exchanged over thirty text messages. 

41. Certain of the electronic messages between Stone and Credico (which Stone denied 
ever taking place or possessing) would have been material to HPSCI, including Stone’s messages 
in or around September 2016 directing Credico to pass a request for documents to Assange, and 
other relevant written communications with Credico. For example, on or about January 6, 2017, 
Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony, 
that had the subject line “Back channel bs.” In the email, Credico wrote, “Well I have put together 
timelines [J and you [] said you have a back-channel way back a month before I had Assange on 
my show... I have never had a conversation with Julian Assange other than my radio show... I 
have pieced it all together ... so you may as well tell the truth that you had no back-channel or 
there’s the guy you were talking about early August.” (A copy of this email was obtained through 
a search of Stone’s email account 
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Stone’s Testimony About Commmicatwns with the Trump Campaign 
42. During his HPSCI testimony, Stone was asked, “[d]id you discuss your 
conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above, Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 
including the following: 

a. As described above, Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials to inform them about materials possessed by Assange 
and the timing of future releases. 


b. 


^on about October 
, “Spoke to my friend in London last night. The 


3, 2016, Stone wrote to | 
payload is still coming.” 

c. As described above, on or about October 4,2016, after receiving information from 
Credico about the delay in WikiLeaks’s release of stolen materials, Stone emailed 
Bannon that Assange had a “[s]erious security concern” but would release “a load 
every week going forward.” 

Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 
43. According to an email recovered through a court-authorized search of Stone’s email 

account^^^^^^^^^^^J on or about October 19, 2017, Stone sent Credico an excerpt of 
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his “intermediary” to 
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he 
should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged 
effort to prevent Credico from contradicting Stone’s false statements to HPSCI. 
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44. In or around November 2017, Credico received a request from HPSCI to testify 
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 
repeatedly with Stone. 



see him. Stone responded,‘“Stonewall it. Plead the fifth. Anything to save the 
plan’ . .. Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 
interview. 

b. On or about November 21, 2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be getting a subpoena.” Stone 
responded, “That was the point at which your lawyers should have told them you 
would assert your 5th Amendment rights if compelled to appear.” (A copy of these 
text messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

c. On or about November 28, 2017, Credico received a subpoena compelling his 
testimony before HPSCI. Credico informed Stone of the subpoena. 

d. According to emails recovered from Stone’s email accoun^^^^^^^^^^^^^ 
on or about November 30,2017, Stone asked Corsi to write publicly about Credico. 
Corsi responded, “Are you sure you want to make something out of this now? Why 
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not wait to see what [Credico] does? You may be defending yourself too much - 
raising new questions that will fuel new inquiries. This may be a time to say less, 
not more.” Stone responded by telling Corsi that Credico “will take the 5th—but 
let’s hold a day.” 

e. According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
II, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.” When interviewed 
by the FBI, Credico confirmed that he understood Stone’s references to Frank 
Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
from investigators. 

f. On or about December 1, 2017, Stone texted Credico, “And if you turned over 
anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You need 
to amend your testimony before I testify on the 15th.” Stone responded, “If you 
testify you’re a fool. Because of tromp I could never get away with a certain [sic] 
my Fifth Amendment rights but you can. I guarantee you you are the one who gets 
indicted for perjury if you’re stupid enough to testify.” (A copy of these text 

, messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

45. On or about December 12,2017, Credico informed HPSCI that he intended to assert 

his Fifth Amendment privilege against self-incrimination if required to appear by subpoena. 
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According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing 
evidence that would show Stone’s previous testimony to Congress was false. 

46. Following Credico’s invocation of his Fifth Amendment privilege not to testify 
before HP SCI, Stone and Credico continued to have discussions about the various investigations 
into Russian interference in the 2016 election and what information Credico would provide to 
investigators. During these conversations, Stone repeatedly made statements intended to prevent 
Credico from cooperating with the investigations. For example: 

a. On or about December 24,2017, Credico texted Stone, “I met assange for f[i]rst 
time this yea[r] sept 7 ... docs prove that... You should be honest w fbi. .. 
there was no back channel... be honest.” Stone replied approximately two 
minutes later, “I’m not talking to the FBI and if your smart you won’t either.” (A 
copy of these text messages was recovered through a court-authorized search of 

i 

Stone’s iCloud account). 

b. On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. A 
stoolie. You backstab your friends—run your mouth my lawyers are dying Rip you 
to shreds.” Stone also said he would “take that dog away from you,” referring to 
Credico’s dog. On or about the same day, Stone wrote to Credico, “I am so ready. 
Let’s get it on. Prepare to die [expletive].” (A copy of this email exchange was 
recovered through a court-authorized search of Stone’s email account 



c. On or about May 21, 2018, Credico wrote in an email to Stone, “You should have 
just been honest with the house Intel committee ... you’ve opened yourself up to 
perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
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You got nothing. Keep running your mouth and I’ll file a bar complaint against 
your friend [the attorney who had the ability to contact Assange](A copy of this 
email exchange was recovered through a court-authorized search of Stone’s email 
accoun^^^^^^^^^^^^i). Credico believed Stone knew that Credico was 
sensitive to having this friend’s name publicly disclosed. 

Missing Electronic Communications and Stone’s Use of Encrypted Communications 

47. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations into 
Russian interference in the U.S. election). However, the government is aware of the existence of 
numerous other relevant electronic communications that it has not yet been able to recover the 
content. 

48. As described above, during his HPSCI testimony, Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 
Credico). In fact, emails and text messages recovered in this investigation show the two 
communicated frequently by email and text messages; court-authorized searches of Stone’s email 
and iCloud accounts confirm that Stone still had those communications at the time he testified in 
or around September 2017. In numerous communications, Stone and Credico discussed Julian 
Assange and WikiLeaks, as well as Stone’s suggestion that Credico was his intermediary to 
Assange. These communications appear relevant and responsive to HPSCI’s inquiry, but Stone 
never disclosed them. 

49. In addition to these emails and text messages in the FBI’s possession, the FBI has 
reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017 and 
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they show text message communications whose content that the government to date has not been 
able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 
2016 and December 2017) the substance of which the government to date has not recovered or 
reviewed. The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after media 
reports in November 2018 stated that Stone’s attorneys were able to extract text messages between 
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have, 
for the same time period, many of Stone’s other text messages. The government seeks these text 
messages believing they may show additional evidence of (1) the falsity of Stone’s HPSCI 

testimony concerning his communications with his “intermediary” and (2) efforts to corruptly 

> 

persuade Credico not to cooperate with pending investigations. 

50. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed 
that Stone has used encrypted applications to communicate with others. Similarly, records 
obtained in this investigation indicate Stone uses multiple applications designed for encrypted 
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communication, including (a) WhatsApp, 11 (b) Signal, 12 (c) Wickr, 13 and (d) ProtonMail. 14 To 
date, the FBI has not obtained any of Stone’s communications conducted through these 
applications. 

a. According to records from Stone’s iCloud account, a copy of the WhatsApp 

application was downloaded to an iPhone registered to Stone on or about October 
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 
email to that they “talk on a secure line” and proposed using WhatsApp. 

b. According to records from Stone’s iCloud account, a copy of the Signal application 
was downloaded to an iPhone registered to Stone on or about August 18, 2016. 
Additionally, text messages recovered from Stone’s iCloud account revealed that 
on or about November 15, 2016, Stone sent an attorney with the ability to contact 


11 According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default message 
application. 

12 According to open sources, Signal is an encrypted communications application allowing the user 
to send one-to-one and group messages, which can include files, voice notes, images and videos, 
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as 
identifiers, and uses end-to-end encryption to secure all communications to other Signal users. 
Signal also allows users to set timers to messages, after which the messages will be deleted from 
both the sender’s and the receivers’ devices. 

13 According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting user 
data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 

14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses client- 
side encryption to protect email contents and user data before they are sent to ProtonMail servers. 
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the 
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and 
EU jurisdiction. 


29 



Case l:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 37 of 56 


Julian Assange a link to download the Signal application. 15 Approximately fifteen 
minutes after sending the link, Stone texted the attorney, “I’m on signal just dial 
my number.” The attorney responded, “I’ll call you.” 

c. According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 
2016. 

d. According to records from Stone’s iCloud account, a copy of the Wickr application 
was downloaded to an iPhone registered to Stone on or about August 5, 2017. 

51. Based on my training and experience, electronic communications using encrypted 
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 
device used to send and receive those communications. Communications from those applications 
can be obtained by law enforcement by searching the device either manually or via a data 
extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wickr, 
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review 
of the device and the downloaded application can reveal other evidence of encrypted 
communications, such as call logs and contact lists. 

52. The FBI continues to seek evidence of Stone’s communications and contacts during 
the period of the 2016 U.S. presidential election and through the present. The FBI believes these 
communications may contain evidence of additional communications concerning Assange, 
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such 

15 This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 
about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State. 
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communications could constitute additional evidence of Stone’s efforts to obstruct HPSCFs 
investigation by showing additional contacts and communications about Assange and WikiLeaks 
that Stone failed to disclose. 

Other Relevant Communications 

53. On May 8, 2018, a law enforcement interview o: 
conducted. ^^Jwas an employee of Stone’s from approximately June 2016 through 
approximately December 2016 and resided in Stone’s previous New York apartment for a period 
of time. ^^Jprovided information technology support for Stone, but was not formally trained to 
do so. ^^|was aware that Stone communicated with Trump during the 2016 presidential 
campaign, and afterward, both in person and by telephone, ^^^provided information about a 
meeting at Trump Tower between Trump and Stone during the time^J worked for him, to which 
Stone carried a “file booklet” with him. Stone tolc^^J the file booklet was important and that 
no one should touch it^^| also said Stone maintained the file booklet in his closet. 

54. On December 3, 2018, law enforcement conducted an interview of an individual 
(“Person 1”) who previously had a professional relationship with a reporter who provided Person 
1 with information about Stone. The reporter relayed to Person 1 that in or around January and 
February 2016, Stone and Trump were in constant communication and that Stone kept 
contemporaneous notes of the conversations. Stone’s purpose in keeping notes was to later provide 
a “post mortem of what went wrong.” 



was 
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B. Probable Cause Justifying Search of the Subject Premises 

55. • Your affiant is aware through the investigation that Stone maintains the Subject 
Premises as his secondary residence. 16 Associates of Stone’s have confirmed that Stone maintains 
the Subject Premises as his residence when he visits New York, New York. 17 

56. Billing records provided by Charter Communications 
determined that the subscriber of services at the Subject Premises 

In a law enforcement interview, stated he worked as Stone’s assistant. The interview of 

m in addition to a review of public source records, determined lives in Florida. 

Your affiant believes established the Charter Communications account at the Subject 

Premises on behalf of Stone. 


58. Stone participated in an on camera interview that was aired on or about November 
2018 at the Subject Premises 18 . Your affiant observed an Apple MacBook Pro computer and an 
iMac in the Subject Premises in the interview. In the interview, Stone was observed departing the 
apartment building that houses the Subject Premises. 


Stone residence 

17 Public real estate listing indicates the Subject Premises has been listed since December 5, 2018 
and will become available for rent on February 1, 2019. A broker for the Subject Premises listing 
stated it was not available for viewing until February 1, 2019 because it was still occupied by the 
tenant. 

18 https://www.washingtonpost.com/politics/2018/11/08/roger-stone-has-rule-deny-everything- 
he~does/?utm_term=. 5 ab41 ac5 df22 


32 












Case l:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 40 of 56 


59. A review of records produced by Uber Technologies, Inc., 

mm determined that on or about December 2018, the user of the account associated with 
Stone’s telephone number and email address used Uber services at addresses at or close to the 
Subject Premises. Your affiant is aware that users of Uber’s services do not always use their 
precise address when arranging for transportation, and believes the addresses close to the Subject 
Premises are consistent with an individual whose destination is the Subject Premises. 

60. Based on law enforcement interviews, your affiant is aware that Stone has used and 
uses cellular telephones, desktop, and laptop computers to conduct electronic communications. 
Stone also configures his computers to create regulars backups of his computers and maintains one 
of these devices at the Subject Premises, which preserves documents and communications. 

61. In or around May 2018, the FBI interviewed an individual (“Person 2”) who 

provided information technology services to Stone. According to Person 2, Stone maintains at 
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop 
computer at one point in time. Person 2 revealed billing receipts 

and invoices issued to Nydia Bertran-Stone for information technology (“IT”) services dated 
January 2015 through May 2018. The records also show that Nydia Bertran-Stone was billed for 
IT services in connection with three different Apple computers. Specifically, the billing receipts 
show services for (1) an Apple iMac (serial number D25SY03RGQ17) configured with the name 
“Stone-Roger-iMac-FL”; (2) a second Apple iMac (serial number D25TC077GQ17) configured 
with the name “Stone-Roger-iMac-NYC”; and (3) an Apple MacBookPro 10 (serial number 
C02KL05EFFT4) configured with the name “Stone-Nydia-MBPR.” According to publicly 
available information, the iMac is one of Apple’s desktop models (i.e., a computer designed to be 
stationary). The naming convention of the computer “Stone-Roger-iMac-NYC” therefore 
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suggests it is a stationary computer used by Stone and located at the Subject Premises. 19 According 
to the billing records, Person 2 was requested to perform remote support services on or about 
March 21,2018 on the computer named “Stone-Roger-iMac-NYC .” 

62. In the aforementioned Washington Post interview of Stone, at least two electronic 
devices are visible to the view, specifically an Apple iMac computer and a MacBook Pro laptop 
computer. 

63. Person 2 also told law enforcement that Stone used the Apple Time Machine 
(“Time Machine”) application to facilitate backups of his computers and that he believed Stone 
used Time Machine on computers in his residences. According to publicly available information, 
Time Machine is the built-in backup feature of Apple computers and can create copies of files on 
a computer, including applications, music, photos, email, documents, and system files. A Time 
Machine backup allows users to restore files from a specific point in time if the original files are 
ever deleted, or if the hard drive is erased or replaced. In order to create backups with Time 
Machine, a user connects an external storage device to the computer and selects that external 
storage device as the backup disk. 20 

Records by show 

2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone 
number (ending According to AT&T, as of January 1, 2015 through approximately 

November 14, 2016, Stone’s telephone number was registered to an Apple iPhone model 5s 

19 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in 
the Subject Residence and conducts most of his work from the office when he is in Florida. 

20 When the external is plugged in, the Time Machine will automatically make hourly backups for 
the past 24 horns, daily backups for the past month, and weekly backups for all previous months. 
The oldest backups are deleted when the external storage device selected as the backup disk is full. 
The external device can be as small as a USB thumb drive. 
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(“iPhone 5s”) (IMSI 310410657061814). On or about November 14, 2016, Stone’s cellular 
telephone number was transferred to an Apple iPhone model 7 ( iPhone 7 ) (IMSI 
310410930460769). On or about September 28, 2018, Stone’s cellular telephone number was 
transferred to an Apple iPhone model XS (“iPhone XS' S ) (IMSI 310410155529814). 

65. Records produced by Uber Technologi es, Inc „ 

show that the account associated with Stone’s telephone number and email address has the [Jber 
application on multiple devices, including a device identified as iPhone 11,2, TJDID - 668EDC66- 
29BF-4AD2-8RCA-D974C7906597. Publicly available information indicates that the identifier 
“iPhone 11.2” conelates to an Apple iPhone model XS. Additionally, the subpoena returns 
identified a device identified as iPhone9,4, UDID - 7161CF59-6F10-4IC8-984B- 

DE0840IEDA74. Publicly available information indicates that the identifier iPhone9,4 correlates 
to an Apple iPhone model iPhone 7 Plus. 
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67. Statements attributed to Stone in recent media articles also indicate that Stone 
retains computer devices that he no longer uses and keeps relevant electronic communications on 
those devices. In or around November 2018, media reports began to publish exceipts of text 


messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from Ston< 

According to these news articles, Stone released these messages to the media outlets, which Stone 
claimed were extracted by his lawyers from “a cell phone he stopped using in 2016/’ Based on 
these statements, your affiant believes the cellular telephone referenced in the article to be the 
iPhone 5 s documented in the aforementioned AT&T records (which records indicate he stopped 
using on or about November 14, 2016). 24 Further, your affiant believes Stone maintains other 
devices he is no longer actively using. 

C. Probable Cause Justifying Search of ESI 

68. I submit that if a computer or storage medium is found on the Subject Premises, 
there is probable cause to believe those records will be stored on that computer or storage medium, 
for at least the following reasons: 


23 See, e.g., “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 
Backchannel,” Daily Caller, Nov. 14,2018, available at https://dailycaller.com/2018/11/14/roger- 
stone-vrildleaks-randy-credico-mueller. 

24 Stone produced some text messages between he and 
Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 
2016. The government believes copies of later-in-time text messages from late 2016 and early 
2017 could be located on another device, such as the iPhone 7 described above, or on backup 
storage media. 
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a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic 
files downloaded to a storage medium can be stored for years at little or no cost. 
Even when files have been deleted, they can be recovered months or years later 
using forensic tools. This is so because when a person “deletes” a file on a 
computer, the data contained in the file does not actually disappear; rather, that data 
remains on the storage medium until it is overwritten by new data. 

b. Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space—that is, in space on the storage medium that is not currently being used 
by an active file—for long periods of time before they are overwritten. In addition, 
a computer’s operating system may also keep a record of deleted data in a “swap” 
or “recovery” file. 

c. Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file system 
data structures, and virtual memory “swap” or paging files. Computer users 
typically do not erase or delete this evidence, because special software is typically 
required for that task. However, it is technically possible to delete this information. 

d. Similarly, files that have been viewed via the Internet are sometimes automatically 
downloaded into a temporary Internet directory or “cache.” 
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69. As further described in Attachment A, this application seeks permission to locate 
not only computer files that might serve as direct evidence of the crimes described on the warrant, 
but also for forensic electronic evidence that establishes how computers were used, the purpose of 
their use, who used them, and when. There is probable cause to believe that this forensic electronic 
evidence will be on any storage medium in the Subject Premises because: 

a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or. of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). Virtual 
memory paging systems can leave traces of information on the storage medium that 
show what tasks and processes were recently active. Web browsers, e-mail 
programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB flash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were 
created, although this information can later be falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, where, 
and how” of the criminal conduct under investigation, thus enabling the United 
States to establish and prove each element or alternatively, to exclude the innocent 
from further suspicion. In my training and experience, information stored within a 
computer or storage media (e.g., registry information, communications, images and 
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movies, transactional information, records of session times and durations, internet 
history, and anti-virus, spyware, and malware detection pro grams) can indicate who 
has used or controlled the computer or storage media. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. The existence or absence of anti-virus, spyware, and 
malware detection programs may indicate whether the computer was remotely 
accessed, thus inculpating or exculpating the computer owner. Further, computer 
and storage media activity can indicate how and when the computer or storage 
media was accessed or used. For example, as described herein, computers typically 
contains information that log: computer user account session times and durations, 
computer activity associated with user accounts, electronic storage media that 
connected with the computer, and the IP addresses through which the computer 
accessed networks and the internet. Such information allows investigators to 
understand the chronological context of computer or electronic storage media 
access, use, and events relating to the crime under investigation. Additionally, 
some information stored within a computer or electronic storage media may provide 
crucial evidence relating to the physical location of other evidence and the suspect. 
For example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data typically 
also contains information indicating when the file or image was created. The 
existence of such image files, along with external device connection logs, may also 
indicate the presence of additional electronic storage media (e.g., a digital camera 
or cellular phone with an incorporated camera). The geographic and timeline 
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information described herein may either inculpate or exculpate the computer user. 
Last, information stored within a computer may provide relevant insight into the 
computer user’s state of mind as it relates to the offense under investigation. For 
example, information within the computer may indicate the owner’s motive and 
intent to commit a crime (e.g., internet searches indicating criminal planning), or 
consciousness of guilt (e.g., running a “wiping” program to destroy evidence on the 
computer or password protecting/encrypting such evidence in an effort to conceal 
it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about how 
computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in advance 
the records to be sought, computer evidence is not always data that can be merely 
reviewed by a review team and passed along to investigators. Whether data stored 
on a computer is evidence may depend on other information stored on the computer 
and the application of knowledge about how a computer behaves. Therefore, 
contextual information necessary to understand other evidence also falls within the 
scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular thing 
is not present on a storage medium. For example, the presence or absence of 
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counter-forensic programs or anti-virus programs (and associated data) may be 
relevant to establishing the user’s intent. 


III. Procedures for Searching ESI 

A. Execution of Warrant for ESI 

70. Federal Rule of Criminal Procedure 41(e)(2)(B) provides that a warrant to search 
for and seize property “may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored information . . . for later review.” Consistent with Rule 41, this 

t 

application requests authorization to seize any computer devices and storage media and transport 
them to an appropriate law enforcement facility for review. This is typically necessary for a number 
of reasons: 


• First, the volume of data on computer devices and storage media is often impractical 
for law enforcement personnel to review in its entirety at the search location. 

• Second, because computer data is particularly vulnerable to inadvertent or intentional 
modification or destruction, computer devices are ideally examined in a controlled 
environment, such as a law enforcement laboratory, where trained personnel, using 
specialized software, can make a forensic copy of the storage media that can be 
subsequently reviewed in a manner that does not change the underlying data. 

• Third, there are so many types of computer hardware and software in use today that it 
can be impossible to bring to the search site all of the necessary technical manuals and 
specialized personnel and equipment potentially required to safely access the 
underlying computer data. 

• Fourth, many factors can complicate and prolong recovery of data from a computer 
device, including the increasingly common use of passwords, encryption, or other 
features.or configurations designed to protect or conceal data on the computer, which 
often take considerable time and resources for forensic personnel to detect and resolve. 

71. In most cases, a thorough search of a premises for information that might be stored 
on storage media often requires the seizure of the physical storage media and later off-site review 
consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes 
possible to make an image copy of storage media. Generally speaking, imaging is the taking of a 
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complete electronic picture of the computer’s data, including all hidden sectors and deleted files. 
Either seizure or imaging is often necessary to ensure the accuracy and completeness of data 
recorded on the storage media, and to prevent the loss of the data either from accidental or 
intentional destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing evidence 
of how a computer has been used, what it has been used for, and who has used it 
requires considerable time, and talcing that much time on premises could be 
unreasonable. As explained above, because the warrant calls for forensic electronic 
evidence, it is exceedingly likely that it will be necessary to thoroughly examine 
storage media to obtain evidence. Storage media can store a large volume of 
information. Reviewing that information for things described in the warrant can 
take weeks or months, depending on the volume of data stored, and would be 
impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on the search site. The vast array of computer hardware 
and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Premises. 
However, taking the storage media off-site and reviewing it in a controlled 
environment will allow its examination with the proper tools and knowledge. 
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c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing with 
specialized forensic tools. 

72. Because multiple people share the Subject Premises as a residence, it is possible 
that the Subject Premises will contain storage media that are predominantly used, and perhaps 
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is 
possible that the things described in this warrant could be found on any of those computers or 
storage media, the warrant applied for would permit the seizure and review of those items as well. 

B. Review of ESI 

73. Following seizure of any computer devices and storage media and/or the creation 
of forensic image copies, law enforcement personnel (who may include, in addition to law 
enforcement officers and agents, attorneys for the government, attorney support staff, agency 
personnel assisting the government in this investigation, and outside technical experts under 
government control) will review the ESI contained therein for information responsive to the 
warrant. 

74. In conducting this review, law enforcement personnel may use various techniques 
to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such 
techniques may include, for example: 

• surveying directories or folders and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); 

• conducting a file-by-file review by “opening” or reading the first few “pages” of such 
files in order to determine their precise contents (analogous to performing a cursory 
examination of each document in a file cabinet to determine its relevance); 

• “scanning” storage areas to discover and possibly recover recently deleted data or 
deliberately hidden files; and 
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• performing electronic keyword searches through all electronic storage areas to 
determine the existence and location of data potentially related to the subject matter of 
the investigation 25 ; and 

• reviewing metadata, system information, configuration files, registry data, and any 
other information reflecting how, when, and by whom the computer was used. 

75. Law enforcement personnel will make reasonable efforts to restrict their search to 
data falling within the categories of evidence specified in the warrant. Depending on the 
circumstances, however, law enforcement personnel may need to conduct a complete review of all 
the ESI from seized devices or storage media to evaluate its contents and to locate all data 
responsive to the warrant. 

76. Review of the items described in Attachment A will be conducted pursuant to 
established procedures designed to collect evidence in a manner consistent with professional 
responsibility requirements concerning the maintenance of attorney-client and other operative 
privileges. The procedures include use of a designated “filter team,” separate and apart from the 
investigative team, in order to address potential privileges. 

C. Return of ESI 

77. If the Government determines that the electronic devices are no longer necessary 
to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to 
Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request. 
Computer data that is encrypted or unreadable will not be returned unless law enforcement 
personnel have determined that the data is not (i) an instrumentality of the offense, (ii) a fruit of 


25 Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work 
only for text data, yet many types of files, such as images and videos, do not store data as searchable text. Moreover, 
even as to text data, there may be information properly subject to seizure but that is not captured by a keyword 
search because the information does not contain the keywords being searched. 
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the criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) evidence of the 
Subject Offenses. 

IV. Conclusion and Ancillary Provisions 

78. Based on the foregoing, I respectfully request the court to issue a warrant to seize 
the items and information specified in Attachment A to this affidavit and to the Search and Seizure 
Warrant. 

79. In light of the confidential nature of the continuing investigation, I respectfully 
request that this affidavit and all papers submitted herewith be maintained under seal until the 
Court orders otherwise. Sealing is necessary because items and information to be seized are 
relevant to an ongoing investigation, and premature disclosure of the contents of this affidavit and 
related documents may have a negative impact on this continuing investigation and may jeopardize 
its effectiveness. 

Respectfully submitted, 



Mickey J. RObinson 
Special Agent 

Federal Bureau of Investigation 


0 


Subscribed and sworn to before me qii this ^y day of January, 2019 


j$a 



THE HONORABLE ROBERT W. LEHRBURGER 
United States Magistrate Judge 
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ATTACHMENT A 

I. Premises to be Searched - Subject Premises 


The premises to be searched (the “Subject Premises”) are described as follows, and 
include all locked and closed containers found therein: 



II. Items to Be Seized 


A. Evidence, Fruits, and Instrumentalities of the Subject Offenses 

The items to be seized from the Subject Premises include the following evidence, fruits, 
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction 
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code, 
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(1) (witness 
tampering); (collectively the “Subject Offenses”), for the period June 2015 to the present, 
described as follows: 

a. Evidence concerning who occupies or owns the Subject Premises, including 
without limitation, utility and telephone bills, mail envelopes, addressed 
correspondence, diaries, statements, identification documents, address books, 
telephone directories, and keys; 

b. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
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c. Documents that reflect communications between Roger Stone and Jerome Corsi 
that concern the Subject Offenses; 

d. Documents reflecting communications between Roger Stone and Randy Credico 
that concern the Subject Offenses; 

e. Documents reflecting communications between Roger Stone and members of the 
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon, 

Paul Manafort, Richard Gates, and Donald J. Trump, that concern the 
Subject Offenses; 

f. Documents related to or discussing investigations into Russian interference in the 
2016 U.S. presidential election and related matters by the U.S. House of 
Representatives Permanent Select Committee on Intelligence; the U.S. Senate 
Select Committee on Intelligence; and/or the Federal Bureau of Investigation; 

g. Records and information relating to the use, ownership, or control of e-mail 

h. Records and information demonstrating who uses, owns, or controls the WhatsApp 
account associated with telephone numbe^^^^^^^^; 

i. Records and information demonstrating who uses, owns, or controls the Signal 
account associated with telephone numbc^^^^^^^^; 

j. Records and information demonstrating who uses, owns, or controls the Wickr 
account associated with telephone numbei^^^^^^^; 

k. Records pertaining to accounts held with Internet Service Providers providing 
seivice at or to the Subject Premises; 
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l. Computers and media storage devices, including tablets/iPads, and records or 
documents demonstrating who operates, owns, or controls such devices, such as 
telephone records, notes, notebooks, diaries, and reference materials, in whatever 
form; and 

m. Cellular telephones, smartphones, or personal data assistant devices, and records or 
documents demonstrating who operates, owns, or controls such devices, such as 
telephone records, notes, notebooks, diaries, and reference materials, in whatever 
form. 

B. Search and Seizure of Electronically Stored Information 

The items to be seized from the Subject Premises also include any computer devices and 
storage media that may contain any electronically stored information falling within the categories 
set forth in Section II.A.a-k of this Attachment above, including, but not limited to, desktop and 
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones, 
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this 
warrant also authorizes the copying of such devices or media for later review. 

The items to be seized from the Subject Premises also include: 

1. Any items or records needed to access the data stored on any seized or copied 
computer devices or storage media, including but not limited to any physical keys, encryption 
devices, or records of login credentials, passwords, private encryption keys, or similar information. 

2. Any items or records that may facilitate a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media. 

3. Any evidence concerning the identities or locations of those persons with access to, 
control over, or ownership of the seized or copied computer devices or storage media. 

C. Review of ESI 

Following seizure of any computer devices and storage media and/or the creation of 
forensic image copies, law enforcement personnel (who may include, in addition to law 
enforcement officers and agents, attorneys for the government, attorney support staff, agency 
personnel assisting the government in this investigation, and outside technical experts under 
government control) are authorized to review the ESI contained therein for information 
responsive to the warrant. 
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In conducting this review, law enforcement personnel may use various techniques to 
locate information responsive to the warrant, including, for example: 

• surveying various file “directories” and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); 

• opening or cursorily reading the first few “pages” of such files in order to determine 
their precise contents; 

• scanning storage areas to discover and possibly recover recently deleted files or 
deliberately hidden files; 

• performing key word searches through all electronic storage areas to determine whether 
occuixences of language contained in such storage areas exist that are intimately related 
to the subject matter of the investigation; and 

• reviewing metadata, system information, configuration files, registry data, and any 
other information reflecting how, when, and by whom the computer was used. 

Law enforcement personnel will make reasonable efforts to search only for files, 
documents, or other electronically stored information within the categories identified in Sections 
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to 
conduct a complete review of all the ESI from seized devices or storage media if necessary to 
evaluate its contents and to locate all data responsive to the warrant. 
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AO 93 (Rev. 12/09) Search and Seizure Warrant 


United States District Court 

for the 

Southern District of Florida 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case No. 19-6033-S N OW 

Fort Lauderdale, Florida (further | 

described in Attachment "A") ' 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern _ District of _ Florida _ 

(identify the person or describe the property to be searched and give its location)'. 
mHHlH Fort Lauderdale, Florida (further described in Allachmenl "A") 

The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized)’. 

See Attachment M B." 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. 

YOU ARE COMMANDED to execute this warrant on or before 

(not ta exceed 14 days) 

in the daytime 6:00 a.m. to 10 p.m. □ at any time in the day or night as I find reasonable cause has been 

established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Lurana S. Snow _. 

(name) 

□ I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
Searched or seized (check the appropriate box) □ for _days (not to exceed 30). 


ESS □ until, the facts justifying, the later specific date of 



Printed name and title 
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ATTACHMENT A 


The address of the 


|, Fort Lauderdale, Florida 
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ATTACHMENT B 

Property to be seized from the Subject Premises 
1. The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 

a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 

b. Documents reflecting communications between Stone and Jerome Corsi; 

c. Documents reflecting communications between Stone and Randy Credico; 

d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon.^^^^^^, 
Paul Manafort, Richard Gates, and Donald J. Trump; 

e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 
the Federal Bureau of Investigation; 

f. Records and information relating to the e-mail accountsH^^^H^^|^^| 
and 

g. Records and information relating to the WhatsApp account associated with 
telephone number 

h. Records and information relating to the Signal account associated with telephone 
number 
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i. Records and information relating to the Wickr account associated with telephone 
number 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 
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AO 93 (Rev. 12/09) Search and Seizure Warrant (Page 2) 


Return 

Case No. : 

19-6033-SNOW 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in 

the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 

I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and title 













1 


w 


Case l:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 7 of 53 

AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 

Southern District of Florida 
In the Matter of the Search of ^ 

(Briefly describe the property to be searched \ 

or identify the person by name and address) ) Case No. 19-6033-SNOW 

Fort Lauderdale, Florida (further described in ) 

Attachment "A") ) 

) 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that 1 have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

Fort Lauderdale, Florida (further described in Attachment "A'') 

located in the Southern District of _ Florida _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment ”B." 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

[?f contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
18U.S.C. 1505 
18U.S.C. 1001 
18 U.S.C. 1512(b)(1) 


Obstruction of Proceeding 
False Statements 
Witness Tampering 


The application is based on these facts: 


Offense Description 


see attached affidavit. 


sf Continued on the attached sheet. 

□ Delayed notice of ______ days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3 103a, the basis of which is set forth on the attached sheet. 

_ ySur / * *7 -- 

——"" Applicant's signature 

_ Curtis A. Heide, Special Agent, FBI _ 

Printed name and title 


Sworn to before me and signed in my presence. 



City and state: Fort La uderdale, F lorida_ _ Lurana S. Snow, United States Magistrate Judge 

Printed name and title 
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ATTACHMENT A 


The address of the Subject Premises is 



Fort Lauderdale, Florida 
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ATTACHMENT B 

Property to be seized from the Subject Premises 
1. The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 

a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 

b. Documents reflecting communications between Stone and Jerome Corsi; 

c. Documents reflecting communications between Stone and Randy Credico; 

d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, 

Paul Manafort, Richard Gates, and Donald J. Trump; 

e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 
the Federal Bureau of Investigation; 

f. Records and information relating to the e-mail accounts 
and 

g. Records and information relating to the WhatsApp account associated with 
telephone number 

h. Records and information relating to the Signal account associated with telephone 
number 


Page 1 of 3 















f 


Case l:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 10 of 53 


i. Records and information relating to the Wickr account associated with telephone 
number 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 
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v 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for the 

premises known and described as Fort Lauderdale, Florida, described in 

the following paragraphs and further in Attachment A. 

2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been since 2006. In the course of my duties, I have been responsible for investigating federal 
crimes and national security matters involving both counterintelligence and issues related to 
cybersecurity. 

3. I am currently involved in the investigation into Roger Jason Stone, Jr., (“Roger 
Stone”) and others known and unknown to the government, for the commission of unlawful 
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i) 
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false 
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, 
in violation of Title 18, United States Code 1512(b)(1) (collectively the “Specified Federal 
Offenses”). 

4. I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, 
and information provided to me by other law enforcement officers and technical experts. 

5. This affidavit is intended to show merely that there is sufficient probable cause 
for the requested warrant and does not set forth all of my knowledge about this matter. Unless 
specifically indicated, all conversations and statements in this affidavit are related in substance 
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and part. Where I assert that an event took place on a particular date, I am asserting it took place 
on or about the date specified. 

6. I make this affidavit in support of an application for a warrant to search the 

premises located at Fort Lauderdale, FL (the “Subject Premises,” as is more 

particularly described in Attachment A), in connection with the Specified Federal Offenses, for 
the items enumerated in Attachment B, which constitute evidence, contraband, fruits, and 
instrumentalities of the Specified Federal Offenses. 

7. For the reasons set forth in this Affidavit, there is probable cause to believe that 
one or more of the Specified Federal Offenses have been committed by Roger Stone and others 
known and unknown to the government. Further, there is probable cause to believe the Subject 
Premises have been used to facilitate the commission of one or more of the Specified Federal 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Specified Federal Offense may be present in the Subject 
Premises. 

PROBABLE CAUSE 

A. Background on Relevant Individuals 

8. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of 
Donald J. Trump (“Trump Campaign”) until in or around August 2015, and subsequently 
maintained regular contact with and publicly supported the Trump Campaign through the 2016 
election. 

9. Julian Assange is the founder and director of WikiLeaks, which is publicly 
described as a non-profit organization that disseminates non-public information and classified 
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media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from 
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in 
London, United Kingdom. 

10. Jerome Corsi is a political commentator who worked with an online media 
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke 
regularly with Stone throughout the campaign, including about the release of stolen documents 
by WikiLeaks. 



12. Based on the investigation to date, Randy Credico was a radio host who has 
known Stone for more than a decade. In testimony before the U.S. House of Representatives 
Permanent Selection Committee on Intelligence (“HPSCI”) on or about September 26, 2017, 
Stone described Credico (without naming him) as an “intermediary,” “go-between,” and “mutual 
friend” to Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified 
Credico by name and claimed Credico was the “gentleman who confirmed for Mr. Stone” that 
Assange, had “‘[e]mails related to Hillary Clinton which are pending publication.’” 

13. Richard Gates is a U.S. citizen who served for years as a political consultant and 
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates 
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates 
pled guilty to one count of conspiracy against the United States and one count of making false 
statements to federal law enforcement officers. United States v. Gates, 1:17-cr-201 (D.D.C.). 
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14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in 
or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the 
chief executive officer of the Trump Campaign. 



B. Hacking Activity During the 2016 Presidential Election 


16. John Podesta is a U.S. citizen who served for years as a political consultant. 
During the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the 
Hillary Clinton presidential campaign (“Clinton Campaign”). On or about March 24, 2016, 
Podesta received a spearphishing 1 email designed to appear as a security notification (a partial 
copy of the email was recovered by the FBI from a subsequent release of stolen emails, 
described below). During an interview with the FBI in or around May 2018, Podesta indicated 
that after receiving the email, his assistant (who also had access to the account) clicked on a link 
within the email and entered the account password when prompted (believing this prompt to be 
part of a security protocol). Based on my training and experience, this activity appears to have 
been a successful spearphishing operation through which an actor would have gained access to 
Podesta’s email account allowing the actor to steal emails and documents from that account. 

17. The Democratic National Committee (“DNC”) and Democratic Congressional 
Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal 

1 In my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 
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elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including 
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by 
the Special Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became 
aware that their computer systems had been compromised by unauthorized intrusions and hired 
the cybersecurity company CrowdStrike to investigate the intrusions and remediate. 

18. On or about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred 
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “[b]oth adversaries 
engage in extensive political and economic espionage for the benefit of the government of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

19. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 
conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in 
the Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s 
military intelligence agency. 

C. WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 

20. As alleged in the Netyksho indictment, after successfully hacking the DNC and 
DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the 
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stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about 
the transfers using online personas created by the GRU, including “Guccifer 2.0” and 
“DCLeaks.” (GRU officers separately used these personas to release some of the stolen 
documents). 

21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents 
stolen from the DNC network. These stolen documents included communications by senior 
DNC officials about campaign strategy, financial and fundraising data, and other documents 
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

22. Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. 

D. Stone’s Communications About WikiLeaks During the Campaign 

23. In April 2018 interviews with the Special Counsel’s Office, Gates stated that 
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone 
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate 
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by 
WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed 
WikiLeaks and Stone’s prediction of the release. 

24. According to Gates, Manafort directed Gates to contact Stone about any 
additional releases and what other information WikiLeaks had regarding the Clinton Campaign. 
Gates contacted Stone, who made statements claiming that there would be potential future 
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel’s 
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Office in or around October 2018, Gates recalled that at one point during the campaign he was 
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly 
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were 
coming. 

25. Emails recovered through a court-authorized search of Stone’s email account 
show that shortly after the July 22, 2016 release of stolen DNC emails 
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 

a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 

line, “Get to Assange.” The body of the message read: “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they 
deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 
Stone’s email to who lived in the United Kingdom and was a supporter 

of the Trump Campaign. 

b. On or about July 31, 2016, Stone emailed Corsi with the subject line, “Call me 

MON.” The body of the email read in part that “should see Assange.” 

c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he 
was currently in Europe and planned to return in mid-August. Corsi stated, “Word 


A search of was authorized on or about September 11, 2017 by the 

U.S. District Court for the District of Columbia. Case No. l:17-mj-661 (D.D.C. Sept. 11, 2017). 
A second search of was authorized on or about August 3, 2018 by the 

U.S. District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). 
On or about September 26, 2018, the government obtained and executed an order pursuant to 18 
U.S.C. § 2703(d) for records connected to Case No. 1:18-SC-2911 

(D.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that 
the account was still active and that the relevant emails described in this affidavit were not 
deleted from the account. 
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is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. 
Impact planned to be very damaging.” In a law enforcement interview, Corsi 
stated that the phrase “friend in embassy” referred to Assange. Corsi added in the 
same email, “Time to let more than Podesta to be exposed as in bed w enemy if 
they are not ready to drop HRC. That appears to be the game hackers are now 
about. Would not hurt to start suggesting HRC old, memory bad, has stroke - 
neither he nor she well. I expect that much of next dump focus, setting stage for 
Foundation debacle.” 

26. According to recorded public statements recovered by the FBI, starting in early 
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 
statements about information he claimed to have learned from Assange: 

a. According to a public video posted to YouTube, on or about August 8, 2016, 
Stone attended a public event in Broward County, Florida. During the event. 
Stone stated, “I actually have communicated with Assange. I believe the next 
tranche of his documents pertain to the Clinton Foundation, but there’s no telling 
what the October surprise may be.” 

b. According to a public video posted to YouTube, on or about August 12, 2016, 
Stone was interviewed for a video segment on the show InfoWars, hosted by Alex 
Jones. During the interview. Stone stated that he was “in communication with 
Assange” but was “not at liberty to discuss what I have.” 

c. According to a public video posted to YouTube, on or about August 16, 2016, 
Stone stated during another interview with Alex Jones that “it became known on 
this program that I have had some back-channel communication with WikiLeaks 
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and Assange.” In a second interview on or about the same day with Dana Loesch 
of the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and 
that they had a “mutual acquaintance who is a fine gentleman.” 

d. According to a video posted to the public website of the TV station C-SPAN, 
during a C-SPAN television interview on or about August 18, 2016, Stone stated 
that he had communicated with Assange through an “intermediary, somebody 
who is a mutual friend.” 

e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 
interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
the interview, Credico asked Stone, “You’ve been in touch indirectly with 
Assange. Can you give us any kind of insight? Is there an October surprise 
happening?” Stone responded, “Well, first of all, I don’t want to intimate in any 
way that I control or have influence with Assange because I do not. . . . We have 
a mutual friend, somebody we both trust and therefore I am a recipient of pretty 
good information.” 

In around November 2018, Stone 

produced a series of text messages between Stone and Credico during the 2016 presidential 
campaign. These text messages show that beginning on or about August 19, 2016, Stone 
exchanged written communications with Credico about what WikiLeaks and Assange planned to 
do. Emails recovered through a court-authorized search of Stone’s email account 

3 As discussed below, Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 
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show additional written communications between Stone and Credico 
about WikiLeaks in or around September 2016. 

a. On or about August 19, 2016, Credico sent a text message to Stone that read in 
part, “I’m going to have Julian Assange on my show next Thursday.” On or 
about August 21, 2016, Credico sent another text message to Stone, writing in 
part, “I have Julian Assange on Thursday so I’m completely tied up on that day.” 

b. On or about August 25, 2016, Assange was a guest on Credico’s radio show for 
the first time. On or about August 26, 2016, Credico sent a text message to Stone 
that stated, “Assange talk[ed] about you last night.” Stone replied and asked what 
Assange said, to which Credico responded, “He didn’t say anything bad we were 
talking about how the Press is trying to make it look like you and he are in 
cahoots.” 

c. On or about August 27, 2016, Credico sent text messages to Stone that said, “We 
are working on a Julian Assange radio show,” and that he (Credico) was “in 
charge” of the project. In a text message sent later that day, Credico added, 
“Julian Assange has kryptonite on Hillary.” 

d. On or about September 18, 2016, Stone sent a text message to Credico that said, 
“I am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 
added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

e. Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 
State. Stone stated, “Please ask Assange for any State or HRC e-mail from 
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August 10 to August 30 — particularly on August 20, 2011 that mention [the 
subject of the article] or confirm this narrative.” 

f. On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message . . . to Assange.” Credico responded, “I did.” On or about September 
20, 2016, Credico forwarded the request to a close friend who was an attorney 
with the ability to contact the Assange. Credico blind-copied Stone on the 
forwarded email. 

g. On or about September 30, 2016, Credico sent Stone via text message a 
photograph of Credico standing outside the Ecuadorian Embassy in London 
where Assange was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday ... now pretend u don’t know me ... 
Hillary’s campaign will die this week,” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4, 2016, which was reported to be the 10-year 
anniversary of the founding of WikiLeaks. 

i. On or about October 2, 2016, Stone emailed Credico, with the subject line 
“WTF?” and a link to an article at the website http://heatst.com/po 1 itics/october- 
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement- 
due-to-security-concems. Credico responded to Stone, “head fake.” 

j. On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off.” Credico initially responded, “I can’t tal[k] about it.” After 
further exchanges with Stone, Credico responded, “I think it[’]s on for 
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tomorrow.” Credico added, “Off the Record Hillary and her people are doing a 
full-court press they [s/c] keep Assange from making the next dump ... That’s all 
I can tell you on this line ... Please leave my name out of it.” 

28. Emails and text messages recovered by the FBI show that, in or around October 
2016, Stone made statements about Assange’s future releases that were similar to prior 
statements Credico made to him. For example: 

a. In a court-authorized search of Stone’s email account^^^^^^^^^^^^^J the 

FBI recovered an email from Stone to sent on or about October 3, 2016, 

which stated in part, “Spoke to my friend in London last night. The payload is 
still coming.” 

b. In a court-authorized search of the FBI also recovered an 

email exchange from on or about October 3, 2016 between Stone and a reporter 
who had connections to Bannon. In the exchange, the reporter asked, “Assange - 
what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell Bannon but he 
doesn’t call me back.” 

c. On or about October 4, 2016, Assange held a press conference but did not release 

any new materials pertaining to the Clinton Campaign. In a court-authorized 

search of the FBI recovered an email exchange between 

Stone and Steve Bannon on or about October 4, 2016 that occurred after the press 

conference. In the exchange, Bannon asked, “What was that this morning???,” 

referring to Assange’s press conference. Stone responded, “Fear. Serious security 

4 A search of was authorized on or about October 17, 2017 by the U.S. 

District Court for the District of Columbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A 
second search of was authorized on or about August 3, 2018 by the U.S. 

District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018). 
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concern. He thinks they are going to kill him and the London police are standing 
do[wn]. However - a load every week going forward.” 
d. In a court-authorized search of Stone’s iCloud account, 5 the FBI recovered text 
messages between Stone and from on or about October 4, 2016. In one 

text message, asked Stone if he had “hear[d] anymore from London.” 

Stone replied, “Yes - want to talk on a secure line - got Whatsapp.” In an 
interview with the Special Counsel’s Office in or around May 2018, 
confirmed that he and Stone spoke and that Stone had told him WikiLeaks had 
more material to release, and that the material was related to senior people 
associated with Clinton. 

29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen 
from Podesta. According to text messages recovered from Stone’s iCloud account, shortly after 
the release, an associate of Bannon sent a text message to Stone that read, “well done.” 
Similarly, during an April 2018 interview, Gates recalled that after the October 7, 2016 
WikiLeaks release, Stone said, “I told you this was coming.” 

E. Stone’s Communications with the House Permanent Select Committee on 

Intelligence 

30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 
allegations of Russian interference in the 2016 presidential election and possible links to 
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about 

5 A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. l:18-sc-662 (D.D.C. Mar. 14, 2018). The 
records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 

6 On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (“SSCI”) announced the committee would conduct an inquiry that would 
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March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 
were of interest to the committee. 

31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily 
appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI 
letter was recovered by the FBI from a court-authorized search of Stone’s email account 

The letter requested Stone produce: 

Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's 
publicly-announced parameters. 

32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and 
stated, “Mr. Stone has no documents, records, or electronically stored information, regardless of 
form, other than those widely available that reasonably could lead to the discovery of any facts 
within the investigation’s publicly-announced parameters.” (A copy of the letter was recovered 
from a court-authorized search of Stone’s email account 

F. Stone’s Testimony Before HPSCI 

33. On or about September 26, 2017, Stone provided HPSCI with an “opening 
statement” that his counsel requested be included as part of the record of proceedings before 
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, * * * 7 Stone 


investigate, among other things, any intelligence regarding links between Russia and individuals 

associated with political campaigns, as well as Russian cyber activity and other “active 

measures” directed against the United States in connection with the 2016 election. 

7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
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stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 
responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” 

34. Also on or about September 26, 2017, Stone provided testimony in a closed 
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was 
transcribed, and a copy of the transcript was obtained by the Department of Justice from HPSCI 
in or around December 2018. Stone appeared before HPSCI under oath and affirmed for the 
record that he would tell the truth. At the beginning of the hearing, Stone was admonished that 
“it is unlawful to deliberately provide false information to Members of Congress or staff’ and 
that “providing false information to this committee or concealing material information from this 
committee is a crime punishable by law.” 

Stone’s Testimony About Documents He Possessed Related to WikiLeaks 

35. During his HPSCI testimony, Stone was asked about HPSCI’s May 2017 
document request and whether Stone had any documents or written communications that 
discussed Julian Assange, Russian interference, or other relevant documents: 

Q: The committee wrote to you on May 9th requesting no later 

than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation. 

You wrote back through counsel that you had no 
documents, records, or electronically stored information 
regardless of form responsive to our requests. Was that a 
false statement? 

A: That is not a false statement. That’s what — I believe that 

to be true. 


Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence from Stone’s counsel to members of HPSCI. 
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[■••] 

Q: So you have no emails to anyone concerning the allegations 

of hacked documents or your conversations with the 
Guccifer 2[,0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 

A: That is correct. Not to my knowledge. I think we met, 

again, the precise criteria of your request, and we complied. 

Again, if you have a more specific request, I’m happy to go 
back and look.... 

Q: I just want to ask you under oath- 

A: We did an extensive search consistent with the direction of 

my attorneys, and we found nothing that met the criteria 
that you asked for. 

Q: I just want to be certain because you are under oath, where 

your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange 
or Guccifer 2[.0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've 
written no documents yourself. 

A: In connection with Russian collusion, consistent with your 

exact and precise request, yes. 

36. In fact, and as described above, Stone had sent and received numerous emails and 
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 


WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 
(including and his iCloud account show 

that, at the time of his testimony, Stone was still in possession of many of these emails and text 

a 

messages at the time he testified on or about September 22, 2017. These written 


1 The warrant for Stone’s email account was obtained on or about 

September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the 
account was active and the emails in question were not deleted from the account. The warrant 
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communications included (a) Stone’s email to Corsi on or about July 25, 2016, that read in part, 
“Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... 
they deal with Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31, 2016 that 
Malloch “should see Assange”; (c) Corsi’s email to Stone on or about August 2, 2016 that stated 
in part: “Word is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in 
Oct. Impact planned to be very damaging.”; (d) dozens of text messages and emails between 
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of 
the election, in which they discussed WikiLeaks and Assange; (e) Stone’s email to^^^ on or 
about October 3, 2016 that read in part “Spoke to my friend in London last night. The payload is 
still coming.”; and (f) Stone’s email to Bannon on or about October 4, 2016 that claimed 
WikiLeaks would release “a load every week going forward.” 

Stone ’s_ Testimony About His Early August 2016 Statements 

37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to 
explain his statements in early August 2016 about being in contact with Assange. Stone was 
specifically asked about his statement on or about August 8, 2016 that “I’ve actually 
communicated with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

38. Stone testified that these public references to having a means of contacting 

WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 

between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 

name of this “intermediary,” but he provided a description in his testimony that was largely 

for Stone’s email account was obtained on or about October 17, 2017 and 

executed shortly thereafter. The warrant for Stone’s iCloud account (which contained the text 
messages described above) was obtained on or about March 14, 2018 and executed shortly 
thereafter. 
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consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr. Stone” that 
Assange had “‘[ejmails related to Hillary Clinton which are pending publication.”’). 

39. In fact, documents recovered during the investigation (including those obtained 


via search warrant returns 


show that Stone did not begin 


approximately eleven days alter stone urst claimed on or aoout August », zuio to "actually nave 
communicated with Assange” and a week after his August 12, 2016 statements of being “in 
communication with Assange” and “not at liberty to discuss what I have.” 

40. When interviewed by the FBI, Credico stated that the first time he ever spoke 
with Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico 
also provided the FBI with partially redacted emails that he claimed were between he and 
another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the 
technical logistics for the interview later that day. During the exchange, Credico offered 
biographical information about himself, apparently as a means of introduction. 


August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When 
interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to 
contact WikiLeaks. 

y As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25, 2016, 
Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico 
texted Stone that “Assange has kryptonite on Hillary.” 


articipated in multiple voluntary interviews. 
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42. In contrast, and as described above, the FBI has identified written 
communications prior to August 8, 2016 in which Stone directed Corsi—not Credico—to contact 
Assange. On or about July 25, 2016, for example, Stone wrote to Corsi, “’Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails . . . they deal with 
Foundation, allegedly.” Similarly, on or about August 2, 2016, Corsi—not Credico—sent an 
email to Stone in which Corsi wrote that “[w]ord is friend in embassy plans 2 more dumps,” 
including one in October. These communications occurred days before Stone’s first public 
statement on or about August 8, 2016 claiming to be in communication with Assange. However, 
at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a 
“go-between,” “intermediary,” or other source for information from WikiLeaks. Similarly, 
Stone also never disclosed his written communications with Corsi to HPSCI when answering 
HPSCI’s questioning about the August 8, 2016 and August 12, 2016 statements about being in 
communication with Assange. 

Stone’s Testimony About QmMMMMMM. tQ d£MHSi 

43. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 
communicate anything else to Assange?” Stone responded, “I did not.” Stone was then asked, 
“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 
not.” 


44. In fact, starting on or about September 18, 2016, Stone directed Credico to pass 
on a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 


a. 


According 

September 


to text messages 


I on 


18, 2016, Stone sent a text message to Credico that said, 


or about 
“I am e- 
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mailing u a request to pass on to Assange.” On or about the same day, Stone 
emailed Credico an article with allegations against then-candidate Clinton related 
to her service as Secretary of State. Stone added, “Please ask Assange for any 
State or HRC e-mail from August 10 to August 30 - particularly on August 20, 
2011 that mention [the subject of the article] or confirm this narrative.” (A copy 
of this email was obtained through a search of Stone’s email account 


b. According to text messages on or about 

September 19, 2016, Stone texted Credico again, writing “Pass my message ... to 
Assange.” Credico responded, “I did.” An email obtained from the account 

shows that on or about September 20, 2016, Credico 
forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 

Stoners Testimony About Written Communications with Credico 
45. During his HPSCI testimony, Stone was asked repeatedly about his 
communications with the person he identified as his intermediary. Stone stated that he had never 
communicated with his intermediary in writing in any way. During one exchange, Stone claimed 
only to have spoken with the intermediary telephonically: 

Q: [H]ow did you communicate the intermediary? 

A: Over the phone. 

Q: And did you have any other means of communicating with 

the intermediary? 


A: No. 


Q: No text messages, no - none of the list, right? 
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A: No. 


Later during his testimony, Stone again denied ever communicating with his intermediary in 
writing: 

Q: So you never communicated with your intermediary in 

writing in any way? 

A: No. 


Q: Never emailed him or texted him? 

A: He’s not an email guy. 

Q: So all your conversations with him were in person or over 

the phone. 

A: Correct. 

46. As described above, Stone and Credico (whom Stone identified as his 
intermediary) engaged in frequent written communication by email and text message. Beginning 
on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone 
and Credico engaged in dozens of communications by email or text message in which they 
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the 
Clinton Campaign. 

47. Written communications between Stone and Credico continued up until Stone’s 
HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 
Stone testified before HPSCI and denied having ever sent or received emails or text messages 
from his identified intermediary, Stone and Credico exchanged over thirty text messages. 

48. Certain of the electronic messages between Stone and Credico (which Stone 
denied ever taking place or possessing) would have been material to HPSCI, including Stone’s 
messages in or around September 2016 directing Credico to pass a request for documents to 
Assange, and other relevant written communications with Credico. For example, on or about 
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January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of 
his HPSCI testimony, that had the subject line “Back channel bs.” In the email, Credico wrote, 
“Well I have put together timelines[] and you [] said you have a back-channel way back a month 
before I had Assange on my show ... I have never had a conversation with Julian Assange other 
than my radio show ... I have pieced it all together ... so you may as well tell the truth that you 
had no back-channel or there’s the guy you were talking about early August.” (A copy of this 
email was obtained through a search of Stone’s email account^^^^^^^^^^^^^l). 

Stone's Testimony About Commmncations_ with the Trump Campaign 
49. During his HPSCI testimony, Stone was asked, “[d]id you discuss your 
conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above, Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 
including the following: 

a. As described above, Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials to inform them about materials possessed by Assange 
and the timing of future releases. 

messages on or 

October 3, 2016, Stone wrote to “Spoke to my friend in London last night. 

The payload is still coming.” 

c. As described above, on or about October 4, 2016, after receiving information 
from Credico about the delay in WikiLeaks’s release of stolen materials, Stone 
emailed Bannon that Assange had a “[sjerious security concern” but would 
release “a load every week going forward.” 
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G. Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 

50. According to an email recovered through a court-authorized search of Stone’s 
email account on or about October 19, 2017, Stone sent Credico an 

excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his 
“intermediary” to Assange. As described below, Credico repeatedly told Stone that his letter was 
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then 
engaged in a prolonged effort to prevent Credico from contradicting Stone’s false statements to 
HPSCI. 


51. In or around November 2017, Credico received a request from HPSCI to testify 
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 
repeatedly with Stone. 



see him. Stone responded, ‘“Stonewall it. Plead the fifth. Anything to save the 
plan’ . . . Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 
interview. 

b. On or about November 21, 2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be getting a subpoena.” Stone 
responded, “That was the point at which your lawyers should have told them you 
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would assert your 5th Amendment rights if compelled to appear.” (A copy of 
these text messages was recovered through a court-authorized search of Stone’s 
iCloud account). 

c. On or about November 28, 2017, Credico received a subpoena compelling his 
testimony before HPSCI. Credico informed Stone of the subpoena. 

d. According to emails recovered from Stone’s email account 

on or about November 30, 2017, Stone asked Corsi to 
write publicly about Credico. Corsi responded, “Are you sure you want to make 
something out of this now? Why not wait to see what [Credico] does? You may 
be defending yourself too much - raising new questions that will fuel new 
inquiries. This may be a time to say less, not more.” Stone responded by telling 
Corsi that Credico “will take the 5th—but let’s hold a day.” 

e. According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
//, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.” When interviewed 
by the FBI, Credico confirmed that he understood Stone’s references to Frank 
Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
from investigators. 

f. On or about December 1, 2017, Stone texted Credico, “And if you turned over 
anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You 
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need to amend your testimony before I testify on the 15th.” Stone responded, “If 
you testify you’re a fool. Because of tromp I could never get away with a certain 
[sic] my Fifth Amendment rights but you can. I guarantee you you are the one 
who gets indicted for perjury if you’re stupid enough to testify.” (A copy of these 
text messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

52. On or about December 12, 2017, Credico informed HPSCI that he intended to 
assert his Fifth Amendment privilege against self-incrimination if required to appear by 
subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid 
providing evidence that would show Stone’s previous testimony to Congress was false. 

53. Following Credico’s invocation of his Fifth Amendment privilege not to testify 
before HPSCI, Stone and Credico continued to have discussions about the various investigations 
into Russian interference in the 2016 election and what information Credico would provide to 
investigators. During these conversations, Stone repeatedly made aggressive statements intended 
to prevent Credico from cooperating with the investigations. For example: 

a. On or about December 24, 2017, Credico texted Stone, “I met assange for f[i]rst 
time this yea[r] sept 7 ... docs prove that... You should be honest w fbi... 
there was no back channel... be honest.” Stone replied approximately two 
minutes later, “I’m not talking to the FBI and if your smart you won’t either.” (A 
copy of these text messages was recovered through a court-authorized search of 
Stone’s iCloud account). 

b. On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. A 
stoolie. You backstab your friends—run your mouth my lawyers are dying Rip 
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you to shreds.” Stone also said he would “take that dog away from you,” 
referring to Credico’s dog. On or about the same day, Stone wrote to Credico, “I 
am so ready. Let’s get it on. Prepare to die [expletive].” (A copy of this email 
exchange was recovered through a court-authorized search of Stone’s email 


account 

c. On or about May 21, 2018, Credico wrote in an email to Stone, “You should have 
just been honest with the house Intel committee .. . you’ve opened yourself up to 
perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
You got nothing. Keep running your mouth and I’ll file a bar complaint against 
your friend [the attorney who had the ability to contact Assange].” (A copy of 
this email exchange was recovered through a court-authorized search of Stone’s 


I). Credico believed Stone knew that Credico 


email account 

was sensitive to having this friend’s name publicly disclosed. 

H. Missing Electronic Communications and Stone’s Use of Encrypted Communications 

54. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations 
into Russian interference in the U.S. election). However, the government is aware of the 
existence of numerous other relevant electronic communications, the content of which it has not 
yet been able to recover. 

55. As described above, during his HPSCI testimony. Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 
Credico). In fact, emails and text messages recovered in this investigation show the two 


Page 26 of 42 




Case l:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 38 of 53 


communicated frequently by email and text messages; court-authorized searches of Stone’s 
email and iCloud accounts confirm that Stone still had those communications at the time he 
testified in or around September 2017. In numerous communications, Stone and Credico 
discussed Julian Assange and WikiLeaks, as well as Stone’s suggestion that Credico was his 
intermediary to Assange. These communications appear relevant and responsive to HPSCI’s 
inquiry, but Stone never disclosed them. 

56. In addition to these emails and text messages in the FBI’s possession, the FBI has 
reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017, 
and they show text message communications whose content that the government to date has not 
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 
2016 and December 2017) the substance of which the government to date has not recovered or 
reviewed. The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after 
media reports in November 2018 stated that Stone’s attorneys were able to extract text messages 
between Stone and Credico from a phone Stone stopped using in 2016. But the government does 
not have, for the same time period, many of Stone’s other text messages. The government seeks 
these text messages believing they may show additional evidence of (1) the falsity of Stone’s 
HPSCI testimony concerning his communications with his “intermediary” and (2) efforts to 
corruptly persuade Credico not to cooperate with pending investigations. 

57. Additionally, the FBI has interviewed multiple associates of Stone, who 
confirmed that Stone has used encrypted applications to communicate with others. Similarly, 
records obtained in this investigation indicate Stone uses multiple applications designed for 
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encrypted communication, including (a) WhatsApp," (b) Signal, 12 (c) Wickr, 13 and (d) 
ProtonMail. 14 To date, the FBI has not obtained any of Stone’s communications conducted 
through these applications. 

a. According to records from Stone’s iCloud account, a copy of the WhatsApp 

application was downloaded to an iPhone registered to Stone on or about October 
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 
email to that they “talk on a secure line” and proposed using 

WhatsApp. 

b. According to records from Stone’s iCloud account, a copy of the Signal 
application was downloaded to an iPhone registered to Stone on or about August 
18, 2016. Additionally, text messages recovered from Stone’s iCloud account 


According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default 
message application. 

12 According to open sources, Signal is an encrypted communications application allowing the 
user to send one-to-one and group messages, which can include files, voice notes, images and 
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile 
numbers as identifiers, and uses end-to-end encryption to secure all communications to other 
Signal users. Signal also allows users to set timers to messages, after which the messages will be 
deleted from both the sender’s and the receivers’ devices. 

13 According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting 
user data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 

14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses 
client-side encryption to protect email contents and user data before they are sent to ProtonMail 
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company 
based in the Canton of Geneva, and its servers are located at two locations in Switzerland, 
outside of US and EU jurisdiction. 
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revealed that on or about November 15, 2016, Stone sent an attorney with the 
ability to contact Julian Assange a link to download the Signal application. 15 
Approximately fifteen minutes after sending the link, Stone texted the attorney, 
“I’m on signal just dial my number.” The attorney responded, “I’ll call you.” 

c. According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 
2016. 

d. According to records from Stone’s iCloud account, a copy of the Wickr 
application was downloaded to an iPhone registered to Stone on or about August 
5,2017. 

58. Based on my training and experience, electronic communications using encrypted 
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 
device used to send and receive those communications. Communications from those 
applications can be obtained by law enforcement by searching the device either manually or via a 
data extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and 
Wickr, that have not been backed up to cloud accounts (such as an iCloud account). 
Additionally, review of the device and the downloaded application can reveal other evidence of 
encrypted communications, such as call logs and contact lists. 

59. The FBI continues to seek evidence of Stone’s communications and contacts 
during the period of the 2016 U.S. presidential election and through the present. The FBI 

15 This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 
about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State.. 
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believes these communications may contain evidence of additional communications concerning 
Assange, WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. 
Such communications could constitute additional evidence of Stone’s efforts to obstruct 
HPSCI’s investigation by showing additional contacts and communications about Assange and 
WikiLeaks that Stone failed to disclose. 

I. Other Relevant Records 

60. On or about May 8, 2018, a law enforcement interview of 

was conducted. ^^|was an employee of Stone’s from approximately June 2016 
through approximately December 2016 and resided in Stone’s previous New York apartment for 
a period of time. ^^Jprovided information technology support for Stone but was not formally 
trained to do so. ^^|was aware that Stone communicated with Trump during the 2016 
presidential campaign, and afterward, both in person and by telephone, ^^^provided 
information about a meeting at Trump Tower between Trump and Stone during the time 
worked for him, to which Stone carried a “file booklet” with him. Stone told ^^|the file 
booklet was important and that no one should touch it. also said Stone maintained the file 
booklet in his closet. 

61. On or about December 3, 2018, law enforcement conducted an interview of an 
individual (“Person 2”) who previously had a professional relationship with a reporter who 
provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or 
around January and February 2016, Stone and Trump were in constant communication and that 
Stone kept contemporaneous notes of the conversations. Stone’s purpose in keeping notes was to 
later provide a “post mortem of what went wrong.” 
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I 


J. The Subject Premises 

62. Your affiant is aware through the investigation that Stone maintains the Subject 
Premises as his primary residence. 16 During physical surveillance of the Subject Premises on or 
about January 14, 2019, the FBI observed Stone at the residence. 

63. Records produced by Comcast on August 23, 2018 

show that the subscriber of high-speed internet service and digital voice services at the 
Subject Premises was Nydia Stone. According to public reporting and law enforcement 
interviews, Nydia Stone is the spouse of Stone. 

64. According to emails obtained through a court-authorized search of Stone’s email 

account Stone sent an email on or about January 2, 2018 requesting the 

recipient “update your files with my new address”; Stone identified the Subject Premises as his 
new address. Additionally, in an email dated on or about August 2, 2018, Stone provided the 
Subject Premises as his shipping address. 

K. Computer Devices at the Subject Residence 

65. Based on law enforcement interviews, your affiant is aware that Stone has used 
and uses cellular telephones, desktop, and laptop computers to conduct electronic 
communications. Stone also configures his computers to create regulars backups of his 
computers and maintains one of these devices at the Subject Premises, which preserves 
documents and communications. 


16 Stone also maintains a residence at 
York. 



New York, New 
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66. In or around May 2018, the FBI interviewed an individual (“Person 2”) who 
provided information technology services to Stone. According to Person 2, Stone maintains at 
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop 
computer at one point in time. ^^^^^^^^^^^^^^^^^^^|Person 2 revealed billing 
receipts and invoices issued to Nydia Bertran-Stone for information technology (“IT”) services 
dated January 2015 through May 2018. The records also show that Nydia Bertran-Stone was 
billed for IT services in connection with three different Apple computers. Specifically, the 
billing receipts show services for (1) an Apple iMac (serial number D25SY03RGQ17) 
configured with the name “Stone-Roger-iMac-FL”; (2) a second Apple iMac (serial number 
D25TC077GQ17) configured with the name “Stone-Roger-iMac-NYC”; and (3) an Apple 
MacBookPro 10 (serial number C02KL05EFFT4) configured with the name “Stone-Nydia- 
MBPR.” According to publicly available information, the iMac is one of Apple’s desktop 
models (i.e., a computer designed to be stationary). The naming convention of the computer 
“Stone-Roger-iMac-FL” therefore suggests it is a stationary computer used by Stone and located 
at the Subject Premises. 17 According to the billing records, the computer was serviced on or 
about May 26, 2018. 

67. Person 2 also told law enforcement that Stone used the Apple Time Machine 

(“Time Machine”) application to facilitate backups of his computers and that he believed Stone 

used Time Machine on computers in his residences. According to publicly available 

information, Time Machine is the built-in backup feature of Apple computers and can create 

copies of files on a computer, including applications, music, photos, email, documents, and 

system files. A Time Machine backup allows users to restore files from a specific point in time 

17 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in 
the Subject Residence and conducts most of his work from the office when he is in Florida. 
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if the original files are ever deleted, or if the hard drive is erased or replaced. In order to create 
backups with Time Machine, a user connects an external storage device to the computer and 
selects that external storage device as the backup disk. 18 

68. Records produced by AT&T show that, 

since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular 
telephone number (ending in According to AT&T, between approximately January 1, 

2015 and November 14, 2016, Stone’s telephone number was registered to an Apple iPhone 
model 5s (“iPhone 5s”) (IMSI 310410657061814). On or about November 14, 2016, Stone’s 
cellular telephone number was transferred to an Apple iPhone model 7 (“iPhone 7”) (IMSI 
310410930460769). On or about September 28, 2018, Stone’s cellular telephone number was 
transferred to an Apple iPhone model XS (“iPhone XS”) (IMSI 310410155529814). 

69. Records produced by Uber Technologies, Inc., 

show that the account associated with Stone’s telephone number and email address has the Uber 
application on multiple devices, including a device identified as iPhonel 1,2, UDID - 668EDC66- 
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier 
“iPhone 11,2” correlates to an Apple iPhone model XS. Additionally, the subpoena returns 
identified a device identified as iPhone9,4, UDID - 7161CF59-6F10-41C8-984B- 

DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 
correlates to an Apple iPhone model iPhone 7 Plus. 

70. Records obtained from a court-authorized pen register/trap & trace (“PRTT”) 

monitoring of Stone’s personal cellular telephone number shows recent activity 

1 ft 

When the external is plugged in, the Time Machine will automatically make hourly backups 
for the past 24 hours, daily backups for the past month, and weekly backups for all previous 
months. The oldest backups are deleted when the external storage device selected as the backup 
disk is full. The external device can be as small as a USB thumb drive. 
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indicating Stone continues to use the number and its associated device. For example, these 
records show that between January 1, 2019 and January 10, 2019, telephone number was 
used to make or receive over 150 telephone calls and send or receive over 750 text messages. 
Likewise, a court-authorized PRTT of Stone’s WhatsApp account (which is registered to Stone’s 
telephone number ^^J) 20 showed the WhatsApp account was used to send or receive 
approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about 
January 1, 2019 and January 10, 2019. 

71. Statements attributed to Stone in recent media articles also indicate that Stone 
retains computer devices that he no longer uses and keeps relevant electronic communications on 
those devices. In or around November 2018, media reports began to publish excerpts of text 
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from Stone 

According to these news articles, Stone released these messages to the media outlets, which 
Stone claimed were extracted by his lawyers from “a cell phone he stopped using in 2016.” 
Based on these statements, your affiant believes the cellular telephone referenced in the article to 
be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he 


19 Installation and use of PRTT devices for was authorized by the U.S. District Court for 

the District of Columbia on or about November 28, 2018. Case No. 1:18-pr-172 (D.D.C. Nov. 
28, 2018). 

Installation and use of PRTT devices for Stone’s WhatsApp account was authorized by the 
U.S. District Court for the District of Columbia on or about December 11, 2018. Case No. 1:18- 
pr-250 (D.D.C. Dec. 11,2018). 

21 See, e.g., “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 
Backchannel,” Daily Caller, Nov. 14, 2018, available at 

https://dailycaller.eom/2018/l 1/14/roger-stone-wikileaks-randy-credico-mueller. 
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stopped using on or about November 14, 2016). 22 Further, your affiant believes Stone maintains 
other devices he is no longer actively using. 

COMPUTERS. ELECTRONIC STORAGE. AND FORENSIC ANALYSIS 

72. As described above and in Attachment B, this application seeks permission to 
search for records that might be found in the Subject Premises, in whatever form they are found. 
One form in which the records might be found is data stored on a computer device’s hard drive 
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic 
storage media or, potentially, the copying of electronically stored information, all under Rule 
41(e)(2)(B). 

73. Probable cause. I submit that if a computer or storage medium is found on the 
Subject Premises, there is probable cause to believe those records will be stored on that computer 
or storage medium, for at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. 
Electronic files downloaded to a storage medium can be stored for years at little 
or no cost. Even when files have been deleted, they can be recovered months or 
years later using forensic tools. This is so because when a person “deletes” a file 
on a computer, the data contained in the file does not actually disappear; rather, 
that data remains on the storage medium until it is overwritten by new data. 


Stone produced some text messages between he and 
Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 
2016. The government believes copies of later-in-time text messages from late 2016 and early 
2017 could be located on another device, such as the iPhone 7 described above, or on backup 
storage media. 
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b. Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space-—that is, in space on the storage medium that is not currently being 
used by an active file—for long periods of time before they are overwritten. In 
addition, a computer’s operating system may also keep a record of deleted data in 
a “swap” or “recovery” file. 

c. Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file 
system data structures, and virtual memory “swap” or paging files. Computer 
users typically do not erase or delete this evidence, because special software is 
typically required for that task. However, it is technically possible to delete this 
information. 

d. Similarly, files that have been viewed via the Internet are sometimes 
automatically downloaded into a temporary Internet directory or “cache.” 

74. Forensic evidence. As further described in Attachment B, this application seeks 
permission to locate not only computer files that might serve as direct evidence of the crimes 
described on the warrant, but also for forensic electronic evidence that establishes how 
computers were used, the purpose of their use, who used them, and when. There is probable 
cause to believe that this forensic electronic evidence will be on any storage medium in the 
Subject Premises because: 


Page 36 of 42 







Case l:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 48 of 53 


a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). 
Virtual memory paging systems can leave traces of information on the storage 
medium that show what tasks and processes were recently active. Web browsers, 
e-mail programs, and chat programs store configuration information on the 
storage medium that can reveal information such as online nicknames and 
passwords. Operating systems can record additional information, such as the 
attachment of peripherals, the attachment of USB flash storage devices or other 
external storage media, and the times the computer was in use. Computer file 
systems can record information about the dates files were created and the 
sequence in which they were created, although this information can later be 
falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the 
United States to establish and prove each element or alternatively, to exclude the 
innocent from further suspicion. In my training and experience, information 
stored within a computer or storage media (e.g., registry information, 
communications, images and movies, transactional information, records of 
session times and durations, internet history, and anti-virus, spyware, and 
malware detection programs) can indicate who has used or controlled the 
computer or storage media. This “user attribution” evidence is analogous to the 
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search for “indicia of occupancy” while executing a search warrant at a residence. 
The existence or absence of anti-virus, spyware, and malware detection programs 
may indicate whether the computer was remotely accessed, thus inculpating or 
exculpating the computer owner. Further, computer and storage media activity 
can indicate how and when the computer or storage media was accessed or used. 
For example, as described herein, computers typically contains information that 
log: computer user account session times and durations, computer activity 
associated with user accounts, electronic storage media that connected with the 
computer, and the IP addresses through which the computer accessed networks 
and the internet. Such information allows investigators to understand the 
chronological context of computer or electronic storage media access, use, and 
events relating to the crime under investigation. Additionally, some information 
stored within a computer or electronic storage media may provide crucial 
evidence relating to the physical location of other evidence and the suspect. For 
example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data 
typically also contains information indicating when the file or image was created. 
The existence of such image files, along with external device connection logs, 
may also indicate the presence of additional electronic storage media (e.g., a 
digital camera or cellular phone with an incorporated camera). The geographic 
and timeline information described herein may either inculpate or exculpate the 
computer user. Last, information stored within a computer may provide relevant 
insight into the computer user’s state of mind as it relates to the offense under 
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investigation. For example, information within the computer may indicate the 
owner’s motive and intent to commit a crime (e.g., internet searches indicating 
criminal planning), or consciousness of guilt (e.g., running a “wiping” program to 
destroy evidence on the computer or password protecting/encrypting such 
evidence in an effort to conceal it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about 
how computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always data that can 
be merely reviewed by a review team and passed along to investigators. Whether 
data stored on a computer is evidence may depend on other information stored on 
the computer and the application of knowledge about how a computer behaves. 
Therefore, contextual information necessary to understand other evidence also 
falls within the scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular 
thing is not present on a storage medium. For example, the presence or absence 
of counter-forensic programs or anti-virus programs (and associated data) may be 
relevant to establishing the user’s intent. 


Page 39 of 42 



Case l:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 51 of 53 


75. Necessity of seizing or copying entire computers or storage media. In most cases, 
a thorough search of a premises for information that might be stored on storage media often 
requires the seizure of the physical storage media and later off-site review consistent with the 
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make 
an image copy of storage media. Generally speaking, imaging is the taking of a complete 
electronic picture of the computer’s data, including all hidden sectors and deleted files. Either 
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded 
on the storage media, and to prevent the loss of the data either from accidental or intentional 
destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing 
evidence of how a computer has been used, what it has been used for, and who 
has used it requires considerable time, and taking that much time on premises 
could be unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on the search site. The vast array of computer hardware 
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and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Premises. 
However, taking the storage media off-site and reviewing it in a controlled 
environment will allow its examination with the proper tools and knowledge, 
c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

76. Nature of examination. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying 
storage media that reasonably appear to contain some or all of the evidence described in the 
warrant, and would authorize a later review of the media or information consistent with the 
warrant. The later review may require techniques, including but not limited to computer-assisted 
scans of the entire medium, that might expose many parts of a hard drive to human inspection in 
order to determine whether it is evidence described by the warrant. 

77. Because multiple people share the Subject Premises as a residence, it is possible 
that the Subject Premises will contain storage media that are predominantly used, and perhaps 
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is 
possible that the things described in this warrant could be found on any of those computers or 
storage media, the warrant applied for would permit the seizure and review of those items as 
well. 


FILTER REVIEW PROCEDURES 

Review of the items described in Attachment B will be conducted pursuant to established 
procedures designed to collect evidence in a manner consistent with professional responsibility 
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requirements concerning the maintenance of attorney-client and other operative privileges. The 
procedures include use of a designated “filter team,” separate and apart from the investigative 
team, in order to address potential privileges. 

SEALING ORDER REQUESTED 

78. It is further respectfully requested that this Court issue an Order sealing, until 
further order of this Court, all papers submitted in support of this application, including the 
application, affidavit, and search warrant, and the requisite inventory notice. Sealing is necessary 
because items and information to be seized are relevant to an ongoing investigation, and 
premature disclosure of the contents of this affidavit and related documents may have a negative 
impact on this continuing investigation and may jeopardize its effectiveness. 

CONCLUSION 


79. Based on the foregoing, your affiant respectfully requests that this Court issue a 
search warrant for the Subject Premises, more particularly described in Attachment A, 


authorizing the seizure of the items described in Attachment B. 


Respectfully submitted, 

Curtis A. Heide 
■Special Agent 

Federal Bureau of Investigation 


Sworn to and subscribed before me on 


this ■ - day of January, 2019. 



UNITED STATES MAGISTRATE JUDGE 


Page 42 of 42 









Case l:19-mc-00029-CRC Document29-34 Filed 04/28/20 Page lot57 


AO 93 (Rev. 12/09) Search and Seizure Warrant 


United States District Court 

for the 

Southern District of Florida 


) 

) 

) Case No. 19-6034-SNOW 

) 

) 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the Southern _ District of _ Florida _ 

(identify the person or describe the property to be searched and give its location)’. 

Oakland Park, Florida(further described in Attachment "A") 

The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized)’. 

See Attachment M B" 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

Oakland Park, Florida (| 
(further described in Attachment "A") 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


property. 




YOU ARE COMMANDED to execute this warrant on or before 




(not to exceed 14 days) 

in the daytime 6:00 a.m. to 10 p.m. □ at any time in the day or night as 1 find reasonable cause has been 

established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Lurana S. Snow _. 

(name) 


□ I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) □ for _ days (not to exceed30). 


Date and time issued: 




□ until, the facts justifying, the later specific date of 



City and state: Fort Lauderdale, Florida __Lu rana S. Snow, United States Magistrate Judge 

Printed name and title 
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ATTACHMENT A 


Oakland Park, Florida 33334. 

The Subject Premises is a commercial space with a glass front door and glass windows covered 


with a black fabric; a green awning bearing the letters “JVR” is above the door. A photograph of 
the exterior of the Subject Premises is attached below. 
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ATTACHMENT B 

Property to be seized from the Subject Premises 
1. The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 

a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 

b. Documents reflecting communications between Stone and Jerome Corsi; 

c. Documents reflecting communications between Stone and Randy Credico; 

d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, 

Paul Manafort, Richard Gates, and Donald J. Trump; 

e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 
the Federal Bureau of Investigation; 

f. Records and information relating to the e-mail accounts^^^^^^^^^^^^B 
and 

g. Records and information relating to the WhatsApp account associated with 
telephone number 

h. Records and information relating to the Signal account associated with telephone 
number 
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i. Records and information relating to the Wickr account associated with telephone 
number 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 
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AO 93 (Rev. 12/09) Search and Seizure Warrant (Page 2) 


Return 

Case No.: 

19-6034-SNOW 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in 

the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge . 


Date: _ _ 

Executing ojficer 's signature 


Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 

Southern District of Florida 
In the Matter of the Search of ^ 

(Briefly describe the property to be searched \ 

or identify the person by name and address) ^ N 0 >j 9-6034-SNOW 

Oakland Park, Florida ^^^^further described ) 

in Attachment "A”) ) 

) 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

Oakland Park, Florida (further described in Attachment "A") 

located in the Southern _ District of_ Florida _, there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment "B" 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
18U.S.C. 1505 
18U.S.C. 1001 
18U.S.C. 1512(b)(1) 


Obstruction of Proceeding 
False Statements 
Witness Tampering 


The application is based on these facts: 


Offense Description 


See attached Affidavit. 


sf Continued on the attached sheet. 

□ Delayed notice of _days (give exact ending date if more than 30 days:_) is requested 



Sworn to before me and signed in my presence. 



City and state: Fort Lauderdale, Florida 



Printed name and title 
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ATTACHMENT A 



Oakland Park, Florida 
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ATTACHMENT B 

Property to be seized from the Subject Premises 
1. The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 

a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 

b. Documents reflecting communications between Stone and Jerome Corsi; 

c. Documents reflecting communications between Stone and Randy Credico; 

d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bartnon, 

Paul Manafort, Richard Gates, and Donald J. Trump; 

e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 
the Federal Bureau of Investigation; 

f. Records and information relating to the e-mail accounts^^^^^^^^^^^^^l 

g. Records and information relating to the WhatsApp account associated with 
telephone number 

h. Records and information relating to the Signal account associated with telephone 
number 
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i. Records and information relating to the Wickx account associated with telephone 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 
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AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for the 

premises known and described as Oakland Park, Florida described 

in the following paragraphs and further in Attachment A. 

2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been since 2006. In the course of my duties, I have been responsible for investigating federal 
crimes and national security matters involving both counterintelligence and issues related to 
cybersecurity. 

3. I am currently involved in the investigation into Roger Jason Stone, Jr., (“Roger 
Stone”) and others known and unknown to the government, for the commission of unlawful 
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i) 
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false 
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, 
in violation of Title 18, United States Code 1512(b)(1) (collectively the “Specified Federal 
Offenses”). 

4. I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, 
and information provided to me by other law enforcement officers and technical experts. 

5. This affidavit is intended to show merely that there is sufficient probable cause 
for the requested warrant and does not set forth all of my knowledge about this matter. Unless 
specifically indicated, all conversations and statements in this affidavit are related in substance 
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and part. Where I assert that an event took place on a particular date, I am asserting that it took 
place on or about the date specified. 

6. I make this affidavit in support of an application for a warrant to search the 

premises located at Oakland Park, Florida (the “Subject Premises,” 

as is more particularly described in Attachment A), in connection with the Specified Federal 
Offenses, for the items enumerated in Attachment B, which constitute evidence, contraband, 
fmits, and instrumentalities of the Specified Federal Offenses. 

7. For the reasons set forth in this Affidavit, there is probable cause to believe that 
one or more of the Specified Federal Offenses have been committed by Roger Stone and others 
known and unknown to the government. Further, there is probable cause to believe the Subject 
Premises have been used to facilitate the commission of one or more of the Specified Federal 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Specified Federal Offense may be present in the Subject 
Premises. 


PROBABLE CAUSE 

A. Background on Relevant Individuals 

8. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of 
Donald J. Trump (“Trump Campaign”) until in or around August 2015, and subsequently 
maintained regular contact with and publicly supported the Trump Campaign through the 2016 
election. 
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9. Julian Assange is the founder and director of WikiLeaks, which is publicly 
described as a non-profit organization that disseminates non-public information and classified 
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from 
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in 
London, United Kingdom. 
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pled guilty to one count of conspiracy against the United States and one count of making false 
statements to federal law enforcement officers. United States v. Gates, l:17-er-201 (D.D.C.). 

14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in 
or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the 
chief executive officer of the Trump Campaign. 



1 In my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 


Page 4 of 46 






Case l:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 16 of 57 


17. The Democratic National Committee (“DNC”) and Democratic Congressional 
Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal 
elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including 
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by 
the Special Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became 
aware that their computer systems had been compromised by unauthorized intrusions and hired 
the cybersecurity company CrowdStrike to investigate the intrusions and remediate. 

18. On or about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred 
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “[b]oth adversaries 
engage in extensive political and economic espionage for the benefit of the government of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

19. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 
conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in 
the Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s 
military intelligence agency. 
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C. WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 

20. As alleged in the Netyksho indictment, after successfully hacking the DNC and 
DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the 
stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about 
the transfers using online personas created by the GRU, including “Guccifer 2.0” and 
“DCLeaks.” (GRU officers separately used these personas to release some of the stolen 
documents). 

21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents 
stolen from the DNC network. These stolen documents included communications by senior 
DNC officials about campaign strategy, financial and fundraising data, and other documents 
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

22. Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. 

D. Stone’s Communications About WikiLeaks During the Campaign 

23. In April 2018 interviews with the Special Counsel’s Office, Richard Gates stated 
that starting in or around May 2016, when Gates was a senior official on the Trump campaign, 
Stone informed members of the Trump Campaign that WikiLeaks had emails from then- 
candidate Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC 
emails by WikiLeaks, Gates observed a conversation between Manafort and Stone in which they 
discussed WikiLeaks and Stone’s prediction of the release. 
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24. According to Gates, Manafort directed Gates to contact Stone about any 
additional releases and what other information WikiLeaks had regarding the Clinton Campaign. 
Gates contacted Stone, who made statements claiming that there would be potential future 
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel’s 
Office in or around October 2018, Gates recalled that at one point during the campaign he was 
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly 
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were 
coming. 


25. Emails recovered through a court-authorized search of Stone’s email account 
|show that shortly after the July 22, 2016 release of stolen DNC emails 
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 

a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 
line, “Get to Assange.” The body of the message read, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they 
deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 
Stone’s email to who lived in the United Kingdom and who was a 

supporter of the Trump Campaign. 


A search of was authorized on or about September 11, 2017 by the 

U.S. District Court for the District of Columbia. Case No. 1:17-mj-661 (D.D.C. Sept. 11, 2017). 
A second search of was authorized on or about August 3, 2018 by the 

U.S. District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). 
On or about September 26, 2018, the government obtained and executed an order pursuant to 18 
U.S.C. § 2703(d) for records connected to Case No. 1:18-SC-2911 

(D.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that 
the account was still active and that the relevant emails described in this affidavit were not 
deleted from the account. 
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b. On or about July 31, 2016, Stone emailed Corsi with the subject line, “Call me 
MON.” The body of the email read in part that^^^^) “should see Assange.” 

c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he 
was currently in Europe and planned to return in mid-August. Corsi stated, “Word 
is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. 
Impact planned to be very damaging.” In a law enforcement interview, Corsi 
stated that the phrase “friend in embassy” referred to Assange. Corsi added in the 
same email, “Time to let more than Podesta to be exposed as in bed w enemy if 
they are not ready to drop HRC. That appears to be the game hackers are now 
about. Would not hurt to start suggesting HRC old, memory bad, has stroke - 
neither he nor she well. I expect that much of next dump focus, setting stage for 
Foundation debacle.” 

26. According to recorded public statements recovered by the FBI, starting in early 
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 
statements about information he claimed to have learned from Assange: 

a. According to a public video posted to YouTube, on or about August 8, 2016, 
Stone attended a public event in Broward County, Florida. During the event, 
Stone stated, “I actually have communicated with Assange. I believe the next 
tranche of his documents pertain to the Clinton Foundation, but there’s no telling 
what the October surprise may be.” 

b. According to a public video posted to YouTube, on or about August 12, 2016, 
Stone was interviewed for a video segment on the show InfoWars, hosted by Alex 
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Jones. During the interview, Stone stated that he was “in communication with 
Assange” but was “not at liberty to discuss what I have.” 

c. According to a public video posted to YouTube, on or about August 16, 2016, 
Stone stated during another interview with Alex Jones that “it became known on 
this program that I have had some back-channel communications with WikiLeaks 
and Assange.” In a second interview on or about the same day with Dana Loesch 
of the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and 
that they had a “mutual acquaintance who is a fine gentleman.” 

d. According to a video posted to the public website of the TV station C-SPAN, 
during a C-SPAN television interview on or about August 18, 2016, Stone stated 
that he had communicated with Assange through an “intermediary, somebody 
who is a mutual friend.” 

e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 
interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
the interview, Credico asked Stone, “You’ve been in touch indirectly with 
Assange. Can you give us any kind of insight? Is there an October surprise 
happening?” Stone responded, “Well, first of all, I don’t want to intimate in any 
way that I control or have influence with Assange because I do not. . . . We have 
a mutual friend, somebody we both trust and therefore I am a recipient of pretty 
good information.” 

In or around November 2018, Stone 

produced a series of text messages between Stone and Credico during the 2016 presidential 
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“Julian Assange has kryptonite on Hillary.” 
d. On or about September 18, 2016, Stone sent a text message to Credico that said, 
“I am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 


As discussed below, Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 
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added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

e. Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 
State. Stone stated, “Please ask Assange for any State or HRC e-mail from 
August 10 to August 30 — particularly on August 20, 2011 that mention [the 
subject of the article] or confirm this narrative.” 

f. On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message ... to Assange.” Credico responded, “I did.” On or about September 
20, 2016, Credico forwarded the request to a close friend who was an attorney 
with the ability to contact the Assange. Credico blind-copied Stone on the 
forwarded email. 

g. On or about September 30, 2016, Credico sent Stone via text message a 
photograph of Credico standing outside the Ecuadorian Embassy in London 
where Assange was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday ... now pretend u don’t know me ... 
Hillary’s campaign will die this week.” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4, 2016, which was reported to be the 10-year 
anniversary of the founding of WikiLeaks. 
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i. On or about October 2, 2016, Stone emailed Credico, with the subject line 
“WTF?” and a link to an article at the website http://heatst.com/politics/october- 
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement- 
due-to-security-concems. Credico responded to Stone, “head fake.” 

j. On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off.” Credico initially responded, “I can’t tal[k] about it.” After 
further exchanges with Stone, Credico responded, “I think it[’]s on for 
tomorrow.” Credico added, “Off the Record Hillary and her people are doing a 
full-court press they [s/c] keep Assange from making the next dump ... That’s all 
I can tell you on this line ... Please leave my name out of it.” 

28. Emails and text messages recovered by the FBI show that, in or around October 
2016, Stone made statements about Assange’s future releases that were similar to prior 
statements made by Credico to him. For example: 

a. In a court-authorized search of Stone’s email account the 

FBI recovered an email from Stone to sent on or about October 3, 2016, 

which stated in part, “Spoke to my friend in London last night. The payload is 
still coming.” 

b. In a court-authorized search of the FBI also recovered an 

email exchange from on or about October 3, 2016 between Stone and a reporter 
who had connections to Bannon. In the exchange, the reporter asked, “Assange - 


4 A search of was authorized on or about October 17, 2017 by the U.S. 

District Court for the District of Columbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A 
second search of was authorized on or about August 3, 2018 by the U.S. 

District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018). 


Page 12 of 46 








Case l:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 24 of 57 


what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell Barrnon but he 
doesn’t call me back.” 

c. On or about October 4, 2016, Assange held a press conference but did not release 
any new materials pertaining to the Clinton Campaign. In a court-authorized 
search ofthe FBI recovered an email exchange between 
Stone and Steve Bannon on or about October 4, 2016 that occurred after the press 
conference. In the exchange, Bannon asked, “What was that this morning???”, 
referring to Assange’s press conference. Stone responded, “Fear. Serious security 
concern. He thinks they are going to kill him and the London police are standing 
do[wn]. However - a load every week going forward.” 

d. In a court-authorized search of Stone’s iCloud account, 5 the FBI recovered text 

messages between Stone and from on or about October 4, 2016. In one 

text message, asked Stone if he had “hear[d] anymore from London.” 

Stone replied, “Yes - want to talk on a secure line - got Whatsapp.” In an 
interview with the Special Counsel’s Office in or around May 2018, Prince 
confirmed that he and Stone spoke and that Stone had told him WikiLeaks had 
more material to release, and that the material was related to senior people 
associated with Clinton. 

29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen 

from Podesta. According to text messages recovered from Stone’s iCloud account, shortly after 

the release, an associate of Bannon sent a text message to Stone that read “well done.” Similarly, 

5 A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:1 S-sc-662 (D.D.C. Mar. 14, 2018). The 
records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 
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during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, 
Stone said, “I told you this was coming.” 

E. Stone’s Communications with the House Permanent Select Committee on 
Intelligence 

30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 
allegations of Russian interference in the 2016 presidential election and possible links to 
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about 
March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 
were of interest to the committee. 


31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily 


appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI 


letter was recovered by the FBI from a court-authorized search of Stone’s email account 



). The letter requested Stone produce: 


Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's 
publicly-announced parameters. 


32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and 


stated that “Mr. Stone has no documents, records, or electronically stored information, regardless 
of form, other than those widely available that reasonably could lead to the discovery of any 


6 On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (“SSCI”) announced the committee would conduct an inquiry that would 
investigate, among other things, any intelligence regarding links between Russia and individuals 
associated with political campaigns, as well as Russian cyber activity and other “active 
measures” directed against the United States in connection with the 2016 election. 
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facts within the investigation’s publicly-announced parameters.” (A copy of the letter was 
recovered from a court-authorized search of Stone’s email account^^^^^^^^^^^^l). 

F. Stone’s Testimony Before HPSCI 

33. On or about September 26, 2017, Stone provided HPSCI with an “opening 
statement” that his counsel requested be included as part of the record of proceedings before 
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, 7 Stone 
stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 
responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” 

34. Also on or about September 26, 2017, Stone provided testimony in a closed 
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was 
transcribed, and a copy of the transcript was obtained by the Special Counsel’s Office from 
HPSCI in or around December 2018. Stone appeared before HPSCI under oath and affirmed for 
the record that he would tell the truth. At the beginning of the hearing, Stone was admonished 
that “it is unlawful to deliberately provide false information to Members of Congress or staff’ 
and that “providing false information to this committee or concealing material information from 
this committee is a crime punishable by law.” 

Stone's Testimony About Documents He Possessed. Related, to WikiLeaks 

35. During his HPSCI testimony, Stone was asked about HPSCI’s May 2017 
document request and whether Stone had any documents or written communications that 

7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence from Stone’s counsel to members of HPSCI. 
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discussed Julian Assange, Russian interference, or other relevant documents: 

Q: The committee wrote to you on May 9th requesting no later 

than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation. 

You wrote back through counsel that you had no 
documents, records, or electronically stored information 
regardless of form responsive to our requests. Was that a 
false statement? 

A: That is not a false statement. That’s what — I believe that 

to be true. 

[...] 

Q: So you have no emails to anyone concerning the allegations 

of hacked documents or your conversations with the 
Guccifer 2[.0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 

A: That is correct. Not to my knowledge. I think we met, 

again, the precise criteria of your request, and we complied. 

Again, if you have a more specific request, I’m happy to go 
back and look.... 

Q: I just want to ask you under oath - 

A: We did an extensive search consistent with the direction of 

my attorneys, and we found nothing that met the criteria 
that you asked for. 

Q: I just want to be certain because you are under oath, where 

your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange 
or Guccifer 2[.0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've 
written no documents yourself. 

A: In connection with Russian collusion, consistent with your 

exact and precise request, yes. 

36. In fact, and as described above, Stone had sent and received numerous emails and 
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 
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WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 

and his iCloud account show 

that, at the time of his testimony, Stone was still in possession of many of these emails and text 
messages at the time he testified on or about September 22, 2017. These written 
communications included (a) Stone’s email to Corsi on or about July 25, 2016 that read in part, 
“Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... 


they deal with Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31,2016 that 
“should see Assange”; (c) Corsi’s email to Stone on or about August 2, 2016 that stated 
in part, “Word is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in 
Oct. Impact planned to be very damaging.”; (d) dozens of text messages and emails between 
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of 
the election, in which they discussed WikiLeaks and Assange; (e) Stone’s email to^^J on or 
about October 3, 2016 that read in part “Spoke to my friend in London last night. The payload is 
still coming.”; and (f) Stone’s email to Bannon on or about October 4, 2016 that claimed 
WikiLeaks would release “a load every week going forward.” 

Stone ’s Testimony About His Early Ausust 201_6 Statement^ 

37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to 
explain his statements in early August 2016 about being in contact with Assange. Stone was 
specifically asked about his statement on or about August 8, 2016 that “I’ve actually 

The warrant for Stone’s email account was obtained on or about 

September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the 
account was active and the emails in question were not deleted from the account. The warrant 
for Stone’s email account was obtained on or about October 17, 2017 and 

executed shortly thereafter. The warrant for Stone’s iCloud account (which contained the text 
messages described above) was obtained on or about March 14, 2018 and executed shortly 
thereafter. 
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communicated with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

38. Stone testified that these public references to having a means of contacting 
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 
between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 
name of this “intermediary,” but he provided a description in his testimony that was largely 
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr. Stone” that 
Assange had “‘[ejmails related to Hillary Clinton which are pending publication.’”). 

39. In fact, documents recovered during the investigation (including those obtained 

via search warrant returns show that Stone did not begin 

communicating with Credico about Assange or WikiLeaks until on or about August 19, 2016 9 — 
approximately eleven days after Stone first claimed on or about August 8, 2016 to “actually have 
communicated with Assange” and a week after his August 12, 2016 statements of being “in 
communication with Assange” and “not at liberty to discuss what I have.” 

40. When interviewed by the FBI, Credico stated that the first time he ever spoke 
with Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico 
also provided the FBI with partially redacted emails that he claimed were between he and 
another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the 

9 As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25, 2016, 
Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico 
texted Stone that “Assange has kryptonite on Hillary.” 

10 Credico was first interviewed by the FBI in or around August 2018. He has subsequently 
participated in multiple voluntary interviews. |mm||||m|BHIIIi 
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technical logistics for the interview later that day. During the exchange, Credico offered 
biographical information about himself, apparently as a means of introduction. 

41. The FBI has not identified any communications between Stone and Credico from 
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When 
interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to 
contact WikiLeaks. 

42. In contrast, and as described above, the FBI has identified written 
communications prior to August 8, 2016 in which Stone directed Corsi—not Credico—to contact 
Assange. On or about July 25, 2016, for example. Stone wrote to Corsi, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails . . . they deal with 
Foundation, allegedly.” Similarly, on or about August 2, 2016, Corsi—not Credico—sent an 
email to Stone in which Corsi wrote that “[w]ord is friend in embassy plans 2 more dumps,” 
including one in October. These communications occurred days before Stone’s first public 
statement on or about August 8, 2016 claiming to be in communication with Assange. However, 
at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a 
“go-between,” “intermediary,” or other source for information from WikiLeaks. Similarly, 
Stone also never disclosed his written communications with Corsi to HPSCI when answering 
HPSCI’s questioning about the August 8, 2016 and August 12, 2016 statements about being in 
communication with Assange. 

Stone's Testimony About Communications to Assange 

43. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 
communicate anything else to Assange?” Stone responded, “I did not.” Stone was then asked. 


Page 19 of 46 



Case l:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 31 of 57 


“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 
not.” 


44. In fact, starting on or about September 18, 2016, Stone directed Credico to pass 
on a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 

a. According to text messages on or about 

September 18, 2016, Stone sent a text message to Credico that said, “I am e- 
mailing u a request to pass on to Assange.” On or about the same day, Stone 
emailed Credico an article with allegations against then-candidate Clinton related 
to her service as Secretary of State. Stone added, “Please ask Assange for any 
State or HRC e-mail from August 10 to August 30 - particularly on August 20, 
2011 that mention [the subject of the article] or confirm this narrative.” (A copy 
of this email was obtained through a search of Stone’s email account 



b. According to text messages on or about 

September 19, 2016, Stone texted Credico again, writing “Pass my message ... to 
Assange.” Credico responded, “I did.” An email obtained from the account 
mi shows that on or about September 20, 2016, Credico 
forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 

Stoned Testimony About Written Communications with Credico 
45. During his HPSCI testimony. Stone was asked repeatedly about his 
communications with the person he identified as his intermediary. Stone stated that he had never 
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communicated with his intermediary in writing in any way. During one exchange, Stone claimed 
only to have spoken with the intermediary telephonically: 

Q: [H]ow did you communicate the intermediary? 

A: Over the phone. 

Q: And did you have any other means of communicating with 

the intermediary? 

A: No. 

Q: No text messages, no - none of the list, right? 

A: No. 

Later during his testimony, Stone again denied ever communicating with his intermediary in 
writing: 

Q: So you never communicated with your intermediary in 

writing in any way? 

A: No. 

Q: Never emailed him or texted him? 

A: He’s not an email guy. 

Q: So all your conversations with him were in person or over 

the phone. 

A: Correct. 

46. As described above, Stone and Credico (whom Stone identified as his 
intermediary) engaged in frequent written communication by email and text message. Beginning 
on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone 
and Credico engaged in dozens of communications by email or text message in which they 
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the 
Clinton Campaign. 
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47. Written communications between Stone and Credico continued up until Stone’s 
HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 
Stone testified before HPSCI and denied having ever sent or received emails or text messages 
from his identified intermediary—Stone and Credico exchanged over thirty text messages. 

48. Certain of the electronic messages between Stone and Credico (which Stone 
denied ever taking place or possessing) would have been material to HPSCI, including Stone’s 
messages in or around September 2016 directing Credico to pass a request for documents to 
Assange, and other relevant written communications with Credico. For example, on or about 
January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of 
his HPSCI testimony, that had the subject line “Back channel bs.” In the email, Credico wrote, 
“Well I have put together timelinesQ and you [] said you have a back-channel way back a month 
before I had Assange on my show ... I have never had a conversation with Julian Assange other 
than my radio show ... I have pieced it all together... so you may as well tell the truth that you 
had no back-channel or there’s the guy you were talking about early August.” (A copy of this 
email was obtained through a search of Stone’s email account^^^^^^^^^^^^^^). 

Stone ’s Testimony About Communications with the Trump Campaign 

49. During his HPSCI testimony, Stone was asked, “[d]id you discuss your 
conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above, Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 
including the following: 
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a. As described above, Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials by telephone to inform them about materials possessed 
by Assange and the timing of future releases. 

b. According to text messages on or about 

October 3, 2016, Stone wrote to “Spoke to my friend in London last night. 

The payload is still coming.” 

c. As described above, on or about October 4, 2016, after receiving information 
from Credico about the delay in WikiLeaks’s release of stolen materials, Stone 
emailed Bannon that Assange had a “[s]erious security concern” but would 
release “a load every week going forward.” 

G. Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 

50. According to an email recovered through a court-authorized search of Stone’s 

email account on or about October 19, 2017, Stone sent Credico an 

excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his 
“intermediary” to Assange. As described below, Credico repeatedly told Stone that his letter was 
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then 
engaged in a prolonged effort to prevent Credico from contradicting Stone’s false statements to 
HPSCI. 

51. In or around November 2017, Credico received a request from HPSCI to testify 
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 



Page 23 of 46 








Case l:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 35 of 57 


a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to 
see him. Stone responded, ‘“Stonewall it. Plead the fifth. Anything to save the 
plan’ . . . Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 
interview. 

b. On or about November 21,2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be getting a subpoena.” Stone 
responded, “That was the point at which your lawyers should have told them you 
would assert your 5th Amendment rights if compelled to appear.” (A copy of 
these text messages was recovered through a court-authorized search of Stone’s 
iCloud account). 

c. On or about November 28, 2017, Credico received a subpoena compelling his 
testimony before HPSCI. Credico informed Stone of the subpoena. 

d. According to emails recovered from Stone’s email account 

on or about November 30, 2017, Stone asked Corsi to 
write publicly about Credico. Corsi responded, “Are you sure you want to make 
something out of this now? Why not wait to see what [Credico] does? You may 
be defending yourself too much - raising new questions that will fuel new 
inquiries. This may be a time to say less, not more.” Stone responded by telling 
Corsi that Credico “will take the 5th—but let’s hold a day.” 
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e. According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
II, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.” When interviewed 
by the FBI, Credico confirmed that he understood Stone’s references to Frank 
Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
from investigators. 

f. On or about December 1, 2017, Stone texted Credico, “And if you turned over 
anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You 
need to amend your testimony before I testify on the 15th.” Stone responded, “If 
you testify you’re a fool. Because of tromp I could never get away with a certain 
[s/c] my Fifth Amendment rights but you can. I guarantee you you are the one 
who gets indicted for perjury if you’re stupid enough to testify.” (A copy of these 
text messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

52. On or about December 12, 2017, Credico informed HPSCI that he intended to 
assert his Fifth Amendment privilege against self-incrimination if required to appear by 
subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid 
providing evidence that would show Stone’s previous testimony to Congress was false. 

53. Following Credico’s invocation of his Fifth Amendment privilege not to testify 
before HPSCI, Stone and Credico continued to have discussions about the various investigations 
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into Russian interference in the 2016 election and what information Credico would provide to 
investigators. During these conversations, Stone repeatedly made aggressive statements intended 
to prevent Credico from cooperating with the investigations. For example: 

a. On or about December 24, 2017, Credico texted Stone, “I met assange for f[i]rst 
time this yea[r] sept 7 . . . docs prove that ... You should be honest w fbi . . . 
there was no back channel ... be honest.” Stone replied approximately two 
minutes later, “I’m not talking to the FBI and if your smart you won’t either.” (A 
copy of these text messages was recovered through a court-authorized search of 
Stone’s iCloud account). 

b. On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. 
You are a stoolie. You backstab your friends—run your mouth my lawyers are 
dying Rip you to shreds.” Stone also said he would “take that dog away from 
you,” referring to Credico’s dog. On or about the same day, Stone wrote to 
Credico, “I am so ready. Let’s get it on. Prepare to die [expletive].” (A copy of 
this email exchange was recovered through a court-authorized search of Stone’s 

account^^^^^^^^^^^l). 

c. On or about May 21, 2018, Credico wrote in an email to Stone, “You should have 
just been honest with the house Intel committee ... you’ve opened yourself up to 
perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
You got nothing. Keep running your mouth and I’ll file a bar complaint against 
your friend [the attorney who had the ability to contact the head of Assange].” 
(A copy of this email exchange was recovered through a court-authorized search 
of Stone’s email account||^^^^^^^^^^^|). Credico believed Stone knew 
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that Credico was sensitive to having this friend’s name publicly disclosed. 

H. Missing Electronic Communications and Stone’s Use of Encrypted Communications 

54. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations 
into Russian interference in the U.S. election). However, the government is aware of the 
existence of numerous other relevant electronic communications, the content of which it has not 
yet been able to recover. 

55. As described above, during his HPSCI testimony. Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 
Credico). In fact, emails and text messages recovered in this investigation show the two 
communicated frequently by email and text messages; court-authorized searches of Stone’s 
email and iCloud accounts confirm that Stone still had those communications at the time he 
testified in or around September 2017. In numerous communications. Stone and Credico 
discussed Julian Assange and WikiLeaks, as well as Stone’s suggestion that Credico was his 
intermediary to Assange. These communications appear relevant and responsive to HPSCI’s 
inquiry, but Stone never disclosed them. 

56. In addition to these emails and text messages in the FBI’s possession, the FBI has 
reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017, 
and they show text message communications whose content that the government to date has not 
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 
2016 and December 2017) the substance of which the government to date has not recovered or 
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reviewed. The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after 
media reports in November 2018 stated that Stone’s attorneys were able to extract text messages 
between Stone and Credico from a phone Stone stopped using in 2016. But the government does 
not have, for the same time period, many of Stone’s other text messages. The government seeks 
these text messages believing they may show additional evidence of (1) the falsity of Stone’s 
HPSCI testimony concerning his communications with his “intermediary” and (2) efforts to 
corruptly persuade Credico not to cooperate with pending investigations. 

57. Additionally, the FBI has interviewed multiple associates of Stone, who 
confirmed that Stone has used encrypted applications to communicate with others. Similarly, 
records obtained in this investigation indicate Stone uses multiple applications designed for 
encrypted communication, including (a) WhatsApp," (b) Signal, 12 (c) Wickr, 13 and (d) 


11 According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default 
message application. 

12 According to open sources, Signal is an encrypted communications application allowing the 
user to send one-to-one and group messages, which can include files, voice notes, images and 
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile 
numbers as identifiers, and uses end-to-end encryption to secure all communications to other 
Signal users. Signal also allows users to set timers to messages, after which the messages will be 
deleted from both the sender’s and the receivers’ devices. 

I 1 

According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting 
user data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 
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ProtonMail. 14 To date, the FBI has not obtained any of Stone’s communications conducted 
through these applications. 

a. According to records from Stone’s iCloud account, a copy of the WhatsApp 

application was downloaded to an iPhone registered to Stone on or about October 
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 
email to that they “talk on a secure line” and proposed using 

WhatsApp. 

b. According to records from Stone’s iCloud account, a copy of the Signal 
application was downloaded to an iPhone registered to Stone on or about August 
18, 2016. Additionally, text messages recovered from Stone’s iCloud account 
revealed that on or about November 15, 2016, Stone sent an attorney with the 
ability to contact Julian Assange a link to download the Signal application. 15 
Approximately fifteen minutes after sending the link, Stone texted the attorney, 
“I’m on signal just dial my number.” The attorney responded, “I’ll call you.” 

c. According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 
2016. 


14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses 
client-side encryption to protect email contents and user data before they are sent to ProtonMail 
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company 
based in the Canton of Geneva, and its servers are located at two locations in Switzerland, 
outside of US and EU jurisdiction. 

15 This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 
about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State. 


Page 29 of 46 





Case l:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 41 of 57 


d. According to records from Stone’s iCloud account, a copy of the Wickr 
application was downloaded to an iPhone registered to Stone on or about August 
5,2017. 

58. Based on my training and experience, electronic communications using encrypted 
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 
device used to send and receive those communications. Communications from those 
applications can be obtained by law enforcement by searching the device either manually or via a 
data extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and 
Wickr, that have not been backed up to cloud accounts (such as an iCloud account). 
Additionally, review of the device and the downloaded application can reveal other evidence of 
encrypted communications, such as call logs and contact lists. 

59. The FBI continues to seek evidence of Stone’s communications and contacts 
during the period of the 2016 U.S. presidential election and through the present. The FBI 
believes these communications may contain evidence of additional communications concerning 
Assange, WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. 
Such communications could constitute additional evidence of Stone’s efforts to obstruct 
HPSCI’s investigation by showing additional contacts and communications about Assange and 
WikiLeaks that Stone failed to disclose. 

I. Other Relevant Records 

60. On or about May 8, 2018, a law enforcement interview of 

was conducted, ^^^was an employee of Stone’s from approximately June 2016 
through approximately December 2016 and resided in Stone’s previous New York apartment for 
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a period of time. ^^^Drovided information technology support for Stone but was not formally 
trained to do so. ^^Jwas aware that Stone communicated with Trump during the 2016 
presidential campaign, and afterward, both in person and by telephone, ^^^provided 
information about a meeting at Trump Tower between Trump and Stone during the time dj 
worked for him, to which Stone carried a “file booklet” with him. Stone told ^^|the file 
booklet was important and that no one should touch it. ^^|also said Stone maintained the file 
booklet in his closet. 

61. On or about December 3, 2018, law enforcement conducted an interview of an 
individual (“Person 2”) who previously had a professional relationship with a reporter who 
provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or 
around January and February 2016, Stone and Trump were in constant communication and that 
Stone kept contemporaneous notes of the conversations. Stone’s purpose in keeping notes was to 
later provide a “post mortem of what went wrong.” 

J. The Subject Premises 

62. Your affiant is aware through the investigation that Stone maintains the Subject 
Premises as his personal office and has done so since at least the 2016 Campaign. Public 
reporting indicates that Stone occupied Subject Premises as his office during the 2016 
Campaign. 16 An April 17, 2017 news article also described Stone’s “personal office” at a 
location matching the description of the Subject Premises. 17 

16 See Roger Stone: Inside The World Of A Political Hitman , CBS Miami, April 17, 2016, 
available at https://miami.cbslocal.com/2016/04/17/roger-stone-inside-the-world-of-a-political- 
hitman/ (“CBS4’s Jim DeFede has known Stone for years and visited him recently at his office in 
a nondescript building in an industrial section of Oakland Park that houses his collection of 
Nixon memorabilia.”). 

17 See Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself 
Washington Post, April 19, 2017, available at https://www.washingtonpost.com/lifestyle/style/ 
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63. According to records recovered from the court-authorized search of Stone’s 

iCloud (discussed above), Stone on or about January 31, 2014 composed a draft email with the 
subject lease for your signature,” the address of the Subject Premises. 

(The recovered record contained no further content). On or about November 27, 2017, Stone 
sent another individual the address of the Subject Premises while arranging a meeting. 

64. Recovered text messages show that Stone has repeatedly identified the Subject 
Premises as his office. 

a. On or about March 30, 2017, Stone directed another individual to send a reporter 
“to my office.” When the other individual asked “address?”, Stone responded, 

in “Oakland park,” which corresponds to the address of the 

Subject Premises. 

b. On or about April 8, 2017, Stone exchanged messages with an individual who 
identified himself as “HH^” a freelance photographer for the Washington 
Post. In the exchange, the photographer wrote he “would like to photograph you 
first thing Tuesday morning ... April 11 if that is convenient.” Stone responded, 
“Yes - let me figure out where.” The photographer then wrote that “[t]he story 
mentions your office, that would be a good location for me.” Stone replied, 

which is the address of the Subject Premises. 


roger-stone-a-master-of-dark-poiitical-arts-is-playing-the-russia-scandal-for-all-its-worth (“The 
next part of the directions to his personal office and broadcast studio calls for locating a “door 
discreetly marked ‘A,’ ” which might be helpful, except for the crucial fact that there is no door 
discreetly marked “A” at the new address next to a bathroom supplies depot. There is, however, 
a blacked-out door with no markings, and the man who emerges from behind it, wearing shorts, 
loafers with no socks, a rakishly loosened tie and an untucked white dress shirt, is unmistakably 
Stone.”). 
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65. In other text messages recovered from Stone’s iCloud, Stone refers to the Subject 
Premises as a “warehouse.” On or about July 25, 2015, Stone wrote another individual, 
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K. Computer Devices at the Subject Premises 

69. Based on law enforcement interviews, your affiant is aware that Stone has used 
and uses cellular telephones, desktop, and laptop computers to conduct electronic 
communications. Stone also configures his computers to create regulars backups. 

70. As described above, in text messages recovered from Stone’s iCloud account, 
Stone indicated the Subject Premises has high-speed internet service (referred to as having “very 
high speed cable” and “high speed net”). 

71. As described above, on or about April 8, 2017, Stone and a photographer hired by 
the Washington Post agreed to meet at the Subject Premises on or about April 11, 2017 in order 
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for the photographer to photograph Stone. On or about April 19, 2017, the Washington Post 




18 “Roger Stone Helped Donald Trump Get Elected President - Now He’s Helping Himself,” 
Washington Post, Apr. 19, 2017, available at https://www.washingtonpost.com/lifestyle/style/ 
roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worth/2017/ 
04/18/1518184e-236f-l 1 e7-b503-9d616bd5a305_story.html?utm_term=.7576648d5cel. 
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Both photographs were credited to the photographer with the first name and the 

caption of the latter photograph read in part, “Stone in his memorabilia-ovemm office.” The 
photographs depict, among other things, multiple computer accessories, including a monitor, 
microphone, and printer. 

72. In addition, messages recovered from the court-authorized search of Stone’s 
iCloud account show that since January 1, 2017, Stone has granted interviews over Skype from 
his office, further indicating he likely has a computer present there. 19 For example, on or about 
December 13, 2017, Stone coordinated an upcoming interview with another individual by text 
message. Stone confirmed the interview, writing that he would participate via “Skype from our 
Florida studio with green screen.” 

73. In or around May 2018, as discussed above, the FBI interviewed Person 1, who 
worked for Stone. Person 1 told the FBI that Stone maintained a computer at the Subject 
Premises. 

74. In or around May 2018, the FBI interviewed an individual (Person 2) who 
provided information technology services to Stone. Person 2 stated that Stone used the Apple 
Time Machine (“Time Machine”) application to facilitate backups of his computers. According 
to publicly available information, Time Machine is the built-in backup feature of Apple 
computers and can create copies of files on a computer, including applications, music, photos, 
email, documents, and system files. A Time Machine backup allows users to restore files from a 
specific point in time if the original files are ever deleted, or if the hard drive is erased or 


19 According to publicly available information, Skype is a telecommunications application 
software that specializes in providing video chat and voice calls between computers, tablets, 
mobile devices, and similar devices via the internet. 
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replaced. In order to create backups with Time Machine, a user connects an external storage 
device to the computer and selects that external storage device as the backup disk. 20 

75. Records produced by AT&T show that, 

since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular 
telephone number (ending in According to AT&T, between approximately January 1, 

2015 and November 14, 2016, Stone’s telephone number was registered to an Apple iPhone 
model 5s (“iPhone 5s”) (IMSI 310410657061814). On or about November 14, 2016, Stone’s 
cellular telephone number was transferred to an Apple iPhone model 7 (“iPhone 7”) (IMSI 
310410930460769). On or about September 28, 2018, Stone’s cellular telephone number was 
transferred to an Apple iPhone model XS (“iPhone XS”) (IMSI 310410155529814). 

76. Records produced by Uber Technologies, 

show that the account associated with Stone’s telephone number and email address has the Uber 
application on multiple devices, including a device identified as iPhone 11,2, UDID - 668EDC66- 
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier 
“iPhonell,2” correlates to an Apple iPhone model XS. Additionally, the subpoena returns 
identified a device identified as iPhone9,4, UDID - 7161CF59-6F10-41C8-984B- 

DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 
correlates to an Apple iPhone model iPhone 7 Plus. 

77. Records obtained from a court-authorized pen register/trap & trace (“PRTT”) 

monitoring of Stone’s personal cellular telephone number shows recent activity 

90 

When the external is plugged in, the Time Machine will automatically make hourly backups 
for the past 24 hours, daily backups for the past month, and weekly backups for all previous 
months. The oldest backups are deleted when the external storage device selected as the backup 
disk is full. The external device can be as small as a USB thumb drive. 
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indicating Stone continues to use the number and its associated device. For example, these 
records show that between January 1, 2019 and January 10, 2019, telephone number x3034 was 
used to make or receive over 150 telephone calls and send or receive over 750 text messages. 
Likewise, a court-authorized PRTT of Stone’s WhatsApp account (which is registered to Stone’s 
telephone number showed the WhatsApp account was used to send or receive 

approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about 
January 1, 2019 and January 10, 2019. 

78. Statements attributed to Stone in recent media articles also indicate that Stone 
retains computer devices that he no longer uses and keeps relevant electronic communications on 
those devices. In or around November 2018, media reports began to publish excerpts of text 
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from Stone 

According to these news articles, Stone released these messages to the media outlets, which 
Stone claimed were extracted by his lawyers from “a cell phone he stopped using in 2016.” 
Based on these statements, your affiant believes the cellular telephone referenced in the article to 
be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he 


21 Installation and use of PRTT devices for x3034 was authorized by the U.S. District Court for 
the District of Columbia on or about November 28, 2018. Case No. 1:18-pr-l72 (D.D.C. Nov. 
28,2018). 

Installation and use of PRTT devices for Stone’s WhatsApp account was authorized by the 
U.S. District Court for the District of Columbia on or about December 11, 2018. Case No. 1:18- 
pr-250 (D.D.C. Dec. 11,2018). 

2J See, e.g,, “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 
Backchannel,” Daily Caller, Nov. 14, 2018, available at 

https://dailycaller.com/2018/11/14/roger-stone-wikileaks-randy-credico-mueller. 
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stopped using on or about November 14, 2016). 24 Further, your affiant believes Stone maintains 
other devices he is no longer actively using. 

COMPUTERS. ELECTRONIC STORAGE. AND FORENSIC ANALYSIS 

79. As described above and in Attachment B, this application seeks permission to 
search for records that might be found in the Subject Premises, in whatever form they are found. 
One form in which the records might be found is data stored on a computer device’s hard drive 
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic 
storage media or, potentially, the copying of electronically stored information, all under Rule 
41(e)(2)(B). 

80. Probable cause. I submit that if a computer or storage medium is found on the 
Subject Premises, there is probable cause to believe those records will be stored on that computer 
or storage medium, for at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. 
Electronic files downloaded to a storage medium can be stored for years at little 
or no cost. Even when files have been deleted, they can be recovered months or 
years later using forensic tools. This is so because when a person “deletes” a file 
on a computer, the data contained in the file does not actually disappear; rather, 
that data remains on the storage medium until it is overwritten by new data. 


24 


Stone produced some text messages between he and 
Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 
2016. The government believes copies of later-in-time text messages from late 2016 and early 
2017 could be located on another device, such as the iPhone 7 described above, or on backup 
storage media. 
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b. Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space—that is, in space on the storage medium that is not currently being 
used by an active file—for long periods of time before they are overwritten. In 
addition, a computer’s operating system may also keep a record of deleted data in 
a “swap” or “recovery” file. 

c. Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file 
system data structures, and virtual memory “swap” or paging files. Computer 
users typically do not erase or delete this evidence, because special software is 
typically required for that task. However, it is technically possible to delete this 
information. 

d. Similarly, files that have been viewed via the Internet are sometimes 
automatically downloaded into a temporary Internet directory or “cache.” 

81. Forensic evidence. As further described in Attachment B, this application seeks 
permission to locate not only computer files that might serve as direct evidence of the crimes 
described on the warrant, but also for forensic electronic evidence that establishes how 
computers were used, the purpose of their use, who used them, and when. There is probable 
cause to believe that this forensic electronic evidence will be on any storage medium in the 
Subject Premises because: 
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a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). 
Virtual memory paging systems can leave traces of information on the storage 
medium that show what tasks and processes were recently active. Web browsers, 
e-mail programs, and chat programs store configuration information on the 
storage medium that can reveal information such as online nicknames and 
passwords. Operating systems can record additional information, such as the 
attachment of peripherals, the attachment of USB flash storage devices or other 
external storage media, and the times the computer was in use. Computer file 
systems can record information about the dates files were created and the 
sequence in which they were created, although this information can later be 
falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the 
United States to establish and prove each element or alternatively, to exclude the 
innocent from further suspicion. In my training and experience, information 
stored within a computer or storage media (e.g., registry information, 
communications, images and movies, transactional information, records of 
session times and durations, internet history, and anti-virus, spyware, and 
malware detection programs) can indicate who has used or controlled the 
computer or storage media. This “user attribution” evidence is analogous to the 
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search for “indicia of occupancy” while executing a search warrant at a residence. 
The existence or absence of anti-virus, spyware, and malware detection programs 
may indicate whether the computer was remotely accessed, thus inculpating or 
exculpating the computer owner. Further, computer and storage media activity 
can indicate how and when the computer or storage media was accessed or used. 
For example, as described herein, computers typically contains information that 
log: computer user account session times and durations, computer activity 
associated with user accounts, electronic storage media that connected with the 
computer, and the IP addresses through which the computer accessed networks 
and the internet. Such information allows investigators to understand the 
chronological context of computer or electronic storage media access, use, and 
events relating to the crime under investigation. Additionally, some information 
stored within a computer or electronic storage media may provide crucial 
evidence relating to the physical location of other evidence and the suspect. For 
example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data 
typically also contains information indicating when the file or image was created. 
The existence of such image files, along with external device connection logs, 
may also indicate the presence of additional electronic storage media (e.g., a 
digital camera or cellular phone with an incorporated camera). The geographic 
and timeline information described herein may either inculpate or exculpate the 
computer user. Last, information stored within a computer may provide relevant 
insight into the computer user’s state of mind as it relates to the offense under 
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investigation. For example, information within the computer may indicate the 
owner’s motive and intent to commit a crime (e.g., internet searches indicating 
criminal planning), or consciousness of guilt (e.g., running a “wiping” program to 
destroy evidence on the computer or password protecting/encrypting such 
evidence in an effort to conceal it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about 
how computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always data that can 
be merely reviewed by a review team and passed along to investigators. Whether 
data stored on a computer is evidence may depend on other information stored on 
the computer and the application of knowledge about how a computer behaves. 
Therefore, contextual information necessary to understand other evidence also 
falls within the scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular 
thing is not present on a storage medium. For example, the presence or absence 
of counter-forensic programs or anti-virus programs (and associated data) may be 
relevant to establishing the user’s intent. 
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82. Necessity of seizing or copying entire computers or storage media. In most cases, 
a thorough search of a premises for information that might be stored on storage media often 
requires the seizure of the physical storage media and later off-site review consistent with the 
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make 
an image copy of storage media. Generally speaking, imaging is the taking of a complete 
electronic picture of the computer’s data, including all hidden sectors and deleted files. Either 
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded 
on the storage media, and to prevent the loss of the data either from accidental or intentional 
destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing 
evidence of how a computer has been used, what it has been used for, and who 
has used it requires considerable time, and taking that much time on premises 
could be unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on the search site. The vast array of computer hardware 
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and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Premises. 
However, taking the storage media off-site and reviewing it in a controlled 
environment will allow its examination with the proper tools and knowledge, 
c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

83. Nature of examination. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying 
storage media that reasonably appear to contain some or all of the evidence described in the 
warrant, and would authorize a later review of the media or information consistent with the 
warrant. The later review may require techniques, including but not limited to computer-assisted 
scans of the entire medium, that might expose many parts of a hard drive to human inspection in 
order to determine whether it is evidence described by the warrant. 

84. Because multiple people share the Subject Premises as a residence, it is possible 
that the Subject Premises will contain storage media that are predominantly used, and perhaps 
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is 
possible that the things described in this warrant could be found on any of those computers or 
storage media, the warrant applied for would permit the seizure and review of those items as 
well. 
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FILTER REVIEW PROCEDURES 

85. Review of the items described in Attachment B will be conducted pursuant to 
established procedures designed to collect evidence in a manner consistent with professional 
responsibility requirements concerning the maintenance of attorney-client and other operative 
privileges. The procedures include use of a designated “filter team,” separate and apart from the 
investigative team, in order to address potential privileges. 

CONCLUSION 

86. Based on the foregoing, your affiant respectfully requests that this Court issue a 
search warrant for the Subject Premises, more particularly described in Attachment A, 
authorizing the seizure of the items described in Attachment B. 

Respectfully submitted, 



Federal Bureau of Investigation 


Sworn and subscribed before me on 


this gP- / day of January, 2019. 



UNITED STATES MAGISTRATE JUDGE 
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